DataPower Gateway 10.6CD vulnerability

What happened

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

Affected versions

DataPower Gateway 10.6CD: 10.6.1 through 10.6.6 (semver); 10.6.0.0 through 10.6.0.10 (semver); 11.0.0.0 through 11.0.0.2 (semver); 10.5.0.0 through 10.5.0.22 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.