Buffer overflow in IBM Personal Communications



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-25029
CWE-ID CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Person Communications (PCOMM)
Other software / Other software solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU88407

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-25029

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the target system.

The vulnerability exists due to IBM Personal Communications includes a Windows service that is vulnerable to remote code execution (RCE) and local privilege escalation (LPE). A remote attacker with network access to a target computer to run commands with full privileges in the context of NT AUTHORITYSYSTEM, move laterally to affected systems and escalate privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Person Communications (PCOMM): before 14.0.7

CPE2.3 External links

http://www.ibm.com/support/pages/node/7147672


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###