#VU8802 Denial of service in IBM iNotes - CVE-2017-7957

Vulnerability identifier: #VU8802

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-7957

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
IBM iNotes
Client/Desktop applications / Messaging software

Vendor: IBM Corporation

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to XStream mishandles attempts to create an instance of the primitive type 'void' during unmarshalling when a certain denyTypes workaround is not used. A remote attacker can perform demonstrated by an xstream.fromXML("<void/>") call, trigger an unmarshalling error in XStream and cause the target service to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation
Install update from vendor's website.

Vulnerable software versions

IBM iNotes: 8.5 - 9.0.1

---

External links
https://www-01.ibm.com/support/docview.wss?uid=swg22005235

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.