CVE:CVE-2020-4434
CNNVD:CNNVD-202006-810
IBM Aspera是美国IBM公司的一套基于IBM FASP协议构建的快速文件传输和流解决方案。
多款IBM产品中存在缓冲区错误漏洞。攻击者可利用该漏洞执行任意代码或造成拒绝服务。以下产品及版本受到影响：IBM Aspera High-Speed Transfer Server 3.9.3及之前版本；High-Speed Transfer Endpoint 3.9.3及之前版本；Proxy Server 1.4.3及之前版本；Transfer Cluster Manager 1.3.1版本和3.9.3及之前版本；Application Platform On Demand 3.7.4及之前版本；Faspex On Demand 3.7.4及之前版本；Server On Demand 3.7.4及之前版本；Shares On Demand 3.7.4及之前版本；Streaming 3.9.3及之前版本；High-Speed Transfer Server for Cloud Pak for Integration (CP4I) 3.9.10及之前版本。
solution:Upgrade ibm aspera_application_platform_on_demand to a higher version than 3.7.4,and avoid the version (,3.7.4]; Upgrade ibm aspera_faspex_on_demand to a higher version than 3.7.4,and avoid the version (,3.7.4]; Upgrade ibm aspera_high-speed_transfer_endpoint to a higher version than 3.9.3,and avoid the version (,3.9.3]; Upgrade ibm aspera_high-speed_transfer_server to a higher version than 3.9.3,and avoid the version (,3.9.3]; Upgrade ibm aspera_high-speed_transfer_server_for_cloud_pak_for_integration to a higher version than 3.9.10,and avoid the version (,3.9.10]; Upgrade ibm aspera_proxy_server to a higher version than 1.4.3,and avoid the version (,1.4.3]; Upgrade ibm aspera_server_on_demand to a higher version than 3.7.4,and avoid the version (,3.7.4]; Upgrade ibm aspera_shares_on_demand to a higher version than 3.7.4,and avoid the version (,3.7.4]; Upgrade ibm aspera_streaming to a higher version than 3.9.3,and avoid the version (,3.9.3]; Upgrade ibm aspera_transfer_cluster_manager to a higher version than 1.3.1,and avoid the version (,1.3.1]