Infinite loop in IBM Intelligent Operations Center

1) Infinite loop

EUVDB-ID: #VU13547

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-8036

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to infinite loop when handling malicious input. A remote attacker can supple specially crafted (or fuzzed) file, trigger out of memory exception and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Intelligent Operations Center: 5.1.0 - 5.2.3

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_intelligent_operations_center:5.1.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_intelligent_operations_center:5.1.0.2:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_intelligent_operations_center:5.1.0.3:*:*:*:*:*:*:

External links

http://www.ibm.com/support/pages/node/7030622

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.