Security Bulletin: Code injection vulnerability in IBM Spectrum Protect for Virtual Environments and IBM Spectrum Protect Snapshot for VMware (CVE-2020-4693)

Summary

Due to improper validation of data prior to export, IBM Spectrum Protect for Virtual Environments and IBM Spectrum Protect Snapshot for VMware may allow an attacker to execute arbitrary code on the system.

Vulnerability Details

CVEID:CVE-2020-4693
**DESCRIPTION:**IBM Spectrum Protect products may allow an attacker to execute arbitrary code on the system, caused by improper validation of data prior to export.
CVSS Base score: 9.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/186782 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V| 8.1.0.0-8.1.10.0
IBM Spectrum Protect Snapshot for VMware| 4.1.0.0-4.1.6.10

Remediation/Fixes

BM Spectrum Protect for Virtual Environments: Data Protection for VMware Release|First Fixing
VRM Level|Platform|Link to Fix
—|—|—|—
8.1| 8.1.11| Linux
Windows|

<https://www.ibm.com/support/pages/node/6152475&gt;

7.1
| 7.1.8.10
| Linux
Windows|

<https://www.ibm.com/support/pages/node/316625&gt;

IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V Release|First Fixing
VRM Level|Platform|Link to Fix
—|—|—|—
8.1| 8.1.11| Linux| <https://www.ibm.com/support/pages/node/6152475&gt;

IBM Spectrum Protect Snapshot
for VMware Release|First Fixing
VRM Level|Platform|Link to Fix
—|—|—|—
4.1| 4.1.6.11| Linux| <https://www.ibm.com/support/pages/node/6405750&gt;

Workarounds and Mitigations

None