SB2022083026 - IBM Elastic Storage System update for glibc
Published: August 30, 2022
Security Bulletin ID
SB2022083026
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Off-by-one (CVE-ID: CVE-2021-3999)
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to an off-by-one error glibc getcwd() function. A remote attacker can pass specially crafted input to the application that is using the affected library version, trigger an off-by-one error and execute arbitrary code on the target system.
Remediation
Install update from vendor's website.
References
- https://www.ibm.com/blogs/psirt/security-bulletin-glibc-vulnerability-affects-ibm-elastic-storage-system-cve-2021-3999/"
- https://www.ibm.com/blogs/psirt/security-bulletin-glibc-vulnerability-affects-ibm-elastic-storage-system-cve-2021-3999/</a></p><p>
- https://www.ibm.com/support/pages/node/6615957</p><p><br></p>