cnvd - cnvd-2021-92970

cnvd-2021-92970

Vulnerability from cnvd

Title: IBM SPSS Statistics for Windows拒绝服务漏洞

Description:

IBM SPSS Statistics是强大的统计软件平台，目前可用于Windows和Mac操作系统。

IBM SPSS Statistics for Windows存在拒绝服务漏洞。本地攻击者可利用该漏洞通过将任意文件写入系统上受管理保护的目录从而导致拒绝服务。

Severity: 低

Patch Name: IBM SPSS Statistics for Windows拒绝服务漏洞的补丁

Patch Description:

IBM SPSS Statistics是强大的统计软件平台，目前可用于Windows和Mac操作系统。

IBM SPSS Statistics for Windows存在拒绝服务漏洞。本地攻击者可利用该漏洞通过将任意文件写入系统上受管理保护的目录从而导致拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/6516680

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-38959

Impacted products

Name
['IBM SPSS Statistics for Windows 24.0', 'IBM SPSS Statistics for Windows 25.0', 'IBM SPSS Statistics for Windows 26.0', 'IBM SPSS Statistics for Windows 27.0', 'IBM SPSS Statistics for Windows 27.0.1', 'IBM SPSS Statistics for Windows 28.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-38959",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-38959"
    }
  },
  "description": "IBM SPSS Statistics\u662f\u5f3a\u5927\u7684\u7edf\u8ba1\u8f6f\u4ef6\u5e73\u53f0\uff0c\u76ee\u524d\u53ef\u7528\u4e8eWindows\u548cMac\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nIBM SPSS Statistics for Windows\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5c06\u4efb\u610f\u6587\u4ef6\u5199\u5165\u7cfb\u7edf\u4e0a\u53d7\u7ba1\u7406\u4fdd\u62a4\u7684\u76ee\u5f55\u4ece\u800c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/6516680",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-92970",
  "openTime": "2021-12-01",
  "patchDescription": "IBM SPSS Statistics\u662f\u5f3a\u5927\u7684\u7edf\u8ba1\u8f6f\u4ef6\u5e73\u53f0\uff0c\u76ee\u524d\u53ef\u7528\u4e8eWindows\u548cMac\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nIBM SPSS Statistics for Windows\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5c06\u4efb\u610f\u6587\u4ef6\u5199\u5165\u7cfb\u7edf\u4e0a\u53d7\u7ba1\u7406\u4fdd\u62a4\u7684\u76ee\u5f55\u4ece\u800c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM SPSS Statistics for Windows\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM SPSS Statistics for Windows 24.0",
      "IBM SPSS Statistics for Windows 25.0",
      "IBM SPSS Statistics for Windows 26.0",
      "IBM SPSS Statistics for Windows 27.0",
      "IBM SPSS Statistics for Windows 27.0.1",
      "IBM SPSS Statistics for Windows 28.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-38959",
  "serverity": "\u4f4e",
  "submitTime": "2021-11-18",
  "title": "IBM SPSS Statistics for Windows\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2021-38959 (GCVE-0-2021-38959)

Vulnerability from cvelistv5

Published

2021-11-17 14:00

Modified

2024-09-17 02:41

Severity ?

6.2 (Medium) - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

CWE

Denial of Service

Summary

IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system. IBM X-Force ID: 212046.

References

▼	URL	Tags
	https://www.ibm.com/support/pages/node/6516680	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/212046	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	IBM	SPSS Statistics	Version: 24.0 Version: 27.0.1 Version: 25.0 Version: 26.0 Version: 27.0 Version: 28.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:51:20.831Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/6516680"
          },
          {
            "name": "ibm-spss-cve202138959-dos (212046)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212046"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SPSS Statistics",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "24.0"
            },
            {
              "status": "affected",
              "version": "27.0.1"
            },
            {
              "status": "affected",
              "version": "25.0"
            },
            {
              "status": "affected",
              "version": "26.0"
            },
            {
              "status": "affected",
              "version": "27.0"
            },
            {
              "status": "affected",
              "version": "28.0"
            }
          ]
        }
      ],
      "datePublic": "2021-11-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system. IBM X-Force ID: 212046."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.4,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/S:U/PR:N/AV:L/I:N/A:H/C:N/UI:N/AC:L/E:U/RC:C/RL:O",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-17T14:00:17",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ibm.com/support/pages/node/6516680"
        },
        {
          "name": "ibm-spss-cve202138959-dos (212046)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212046"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "DATE_PUBLIC": "2021-11-16T00:00:00",
          "ID": "CVE-2021-38959",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SPSS Statistics",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "24.0"
                          },
                          {
                            "version_value": "27.0.1"
                          },
                          {
                            "version_value": "25.0"
                          },
                          {
                            "version_value": "26.0"
                          },
                          {
                            "version_value": "27.0"
                          },
                          {
                            "version_value": "28.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system. IBM X-Force ID: 212046."
            }
          ]
        },
        "impact": {
          "cvssv3": {
            "BM": {
              "A": "H",
              "AC": "L",
              "AV": "L",
              "C": "N",
              "I": "N",
              "PR": "N",
              "S": "U",
              "UI": "N"
            },
            "TM": {
              "E": "U",
              "RC": "C",
              "RL": "O"
            }
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ibm.com/support/pages/node/6516680",
              "refsource": "CONFIRM",
              "title": "IBM Security Bulletin 6516680 (SPSS Statistics)",
              "url": "https://www.ibm.com/support/pages/node/6516680"
            },
            {
              "name": "ibm-spss-cve202138959-dos (212046)",
              "refsource": "XF",
              "title": "X-Force Vulnerability Report",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212046"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2021-38959",
    "datePublished": "2021-11-17T14:00:17.939440Z",
    "dateReserved": "2021-08-16T00:00:00",
    "dateUpdated": "2024-09-17T02:41:32.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted