CVE-2022-22333 — Classic Buffer Overflow in IBM Sterling Secure Proxy

CWE-120 — Classic Buffer Overflow3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 29.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Sterling Secure ProxyIBM Sterling External Authentication Server
Timeline
PublishedFeb 23
Latest updateFeb 24

Description

IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, due to the Jetty based GUI in the Secure Zone not properly validating the sizes of the form content and/or HTTP headers submitted. A local attacker positioned inside the Secure Zone could submit a specially crafted HTTP request to disrupt service. IBM X-Force ID: 219133.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5ibm/sterling_secure_proxy3.4.3.2, 6.0.2.0, 6.0.3.0+2
▶NVDibm/sterling_secure_proxy3.4.3.2, 6.0.2, 6.0.3.0+2
▶NVDibm/sterling_external_authentication_server3.4.3.2, 6.0.2.0, 6.0.3.0+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-35cr-x5j7-prhh: IBM Sterling Secure Proxy 6↗2022-02-24
▶
CVEList
CVE-2022-22333: IBM Sterling Secure Proxy 6↗2022-02-23
▶
CVE-2022-22333 — Classic Buffer Overflow in IBM | cvebase