02-13-2021 , 10:07 PM
Researchers at TIM’s Red Team Research discovered a zero-day vulnerability in IBM InfoSphere Information Server.
Today, TIM’s Red Team Research led by Massimiliano Brolli, discovered a new critical vulnerability in IBM InfoSphere Information Server. The flaw has not addressed by IBM, because the product version 8.5.0.0 is in End-of-life.
IBM InfoSphere Information Server is a data management product.
According to the product description from the vendor page:
“IBM InfoSphere Information Server Enterprise Edition is an industry-leading, end-to-end data platform that provides a complete suite of capabilities. These capabilities include automated data discovery, policy-driven governance, self-service data preparation, data quality assessment and cleansing for data in flight and at rest, and advanced dynamic or batch data transformation and movement. It helps you deliver trusted business-ready data to your key business initiatives such as big data, data lakes, data warehouse modernization and master data management.”
Cybersecurity researchers identified a Deserialization of Untrusted Data (CWE-502), identified as CVE-2020-27583, has a CVSS3 score of 9.8. The vulnerability allows unrestricted remote code execution with root privileges, without requiring any authentication.
The laboratory has identified, from public sources available on the corporate website, vulnerabilities on vendors such as Oracle, Nokia, Siemens, Schneider Electric, QNAP, Selesta, WOWZA, MultiUX and recently WordPress, helping to improve overall IT security.
The complete list of CVEs discovered by TIM researchers (formerly Telecom Italia S.p.A.) are available on the TIM Corporate websites:
https://www.gruppotim.it/redteam
TIM is one of the main Italian telecommunications companies, it is one of the few Italian industrial companies that has devoted such an important effort to the search for undocumented vulnerabilities.
Source
Today, TIM’s Red Team Research led by Massimiliano Brolli, discovered a new critical vulnerability in IBM InfoSphere Information Server. The flaw has not addressed by IBM, because the product version 8.5.0.0 is in End-of-life.
IBM InfoSphere Information Server is a data management product.
According to the product description from the vendor page:
“IBM InfoSphere Information Server Enterprise Edition is an industry-leading, end-to-end data platform that provides a complete suite of capabilities. These capabilities include automated data discovery, policy-driven governance, self-service data preparation, data quality assessment and cleansing for data in flight and at rest, and advanced dynamic or batch data transformation and movement. It helps you deliver trusted business-ready data to your key business initiatives such as big data, data lakes, data warehouse modernization and master data management.”
Cybersecurity researchers identified a Deserialization of Untrusted Data (CWE-502), identified as CVE-2020-27583, has a CVSS3 score of 9.8. The vulnerability allows unrestricted remote code execution with root privileges, without requiring any authentication.
The laboratory has identified, from public sources available on the corporate website, vulnerabilities on vendors such as Oracle, Nokia, Siemens, Schneider Electric, QNAP, Selesta, WOWZA, MultiUX and recently WordPress, helping to improve overall IT security.
The complete list of CVEs discovered by TIM researchers (formerly Telecom Italia S.p.A.) are available on the TIM Corporate websites:
https://www.gruppotim.it/redteam
TIM is one of the main Italian telecommunications companies, it is one of the few Italian industrial companies that has devoted such an important effort to the search for undocumented vulnerabilities.
Source