TippingPoint Zero Day Initiative
 

IBM Cognos tm1admsd.exe Multiple Operations Remote Code Execution Vulnerabilities

ZDI-12-101: June 27th, 2012

CVE ID

CVSS Score

Affected Vendors

Affected Products

Vulnerability Details


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Cognos. Authentication is not required to exploit this vulnerability.

The flaw exists within the tm1admsd.exe component. This process listens on TCP port 5498 by default. Requests to the service include a request type field, a data length field, and a data field. Multiple request types (opcodes) fail to validate user supplied length and data fields before copying their contents to a fixed length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the system.

Vendor Response

IBM has issued an update to correct this vulnerability. More details can be found at:

Disclosure Timeline

    2011-11-21 - Vulnerability reported to vendor
    2012-06-27 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Anonymous