Security Bulletin: A busybox vulnerability affects IBM DataPower Gateways (CVE-2014-4607)

Summary

A buffer overflow vulnerability affects IBM DataPower Gateways. IBM DataPower Gateways has addressed the applicable CVE

Vulnerability Details

CVEID: CVE-2014-4607**
DESCRIPTION:** Oberhumer LZO could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the lzo1x_decompress_safe() function when processing zero bytes. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/94014 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Affected Products and Versions

IBM DataPower Gateway Docker virtual appliances version 7.5.2.0

Remediation/Fixes

Fix is available in version 7.5.2.1. Refer to APAR IT17299 for URLs to download the fix.

You should verify applying this fix does not cause any compatibility issues.