Detections
Analytics

IBM Aspera Faspex < 4.4.2 Patch Level 2 Multiple Vulnerabilities

critical Nessus Plugin ID 173033

Language:

Synopsis

A file transfer application running on the remote web server is affected by multiple vulnerabilities.

Description

According to its self-reported version, the instance of IBM Aspera Faspex running on the remote web server is prior to 4.4.2 Patch Level 2. It is, therefore, affected by multiple vulnerabilities, including:

 - IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. (CVE-2022-47986)

 - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. (CVE-2018-25032)

 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. (CVE-2022-26377)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to IBM Aspera Faspex version 4.4.2 Patch Level 2 or later.

See Also

https://www.ibm.com/support/pages/node/6952319

Plugin Details

Severity: Critical

ID: 173033

File Name: ibm_aspera_faspex_4_4_2_185316.nasl

Version: 1.2

Type: remote

Family: CGI abuses

Published: 3/20/2023

Updated: 3/21/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-2068

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2022-47986

Vulnerability Information

CPE: cpe:/a:ibm:aspera_faspex

Required KB Items: installed_sw/IBM Aspera Faspex

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/6/2023

Vulnerability Publication Date: 3/6/2023

CISA Known Exploited Vulnerability Due Dates: 3/14/2023

Reference Information

CVE: CVE-2018-25032, CVE-2022-2068, CVE-2022-26377, CVE-2022-28330, CVE-2022-28615, CVE-2022-30522, CVE-2022-30556, CVE-2022-31813, CVE-2022-47986, CVE-2023-22868