CERT-In Vulnerability Note
CIVN-2010-0272
Multiple Vulnerabilities in IBM Tivoli Storage Manager (TSM)
Original Issue Date:December 23, 2010
Severity Rating: HIGH
Systems Affected
- IBM Tivoli Storage Manager (TSM) Client versions 6.x
- IBM Tivoli Storage Manager (TSM) Client versions 5.x
Overview
Multiple vulnerabilities have been reported in Tivoli Storage Manager (TSM) which can allow remote or local attackers to gain unauthorized access to execute arbitrary code.
Description
1. TSM UNIX and Linux Space Management client Vulnerability
A remote script execution vulnerability exists in the TSM UNIX and Linux Space Management client which could allow remote attackers to execute arbitrary commands. Note: All backup-archive clients, and the HSM for Windows clients, are unaffected by this vulnerability.
2. UNIX and Linux backup-archive client TCA Vulnerability
Buffer overrun vulnerability exists in the TSM UNIX and Linux Trusted Communications Agent (TCA). The vulnerability is caused by a buffer overflow error in the "GeneratePassword()" function within the TSM UNIX and Linux Trusted Communications Agent (TCA), which could allow malicious users to crash an affected client or execute arbitrary code. Note: All Windows and NetWare backup-archive clients and all 6.2 clients are unaffected.
3. TSM UNIX and Linux backup-archive clients Vulnerability
An unauthorized access vulnerability in the TSM UNIX and Linux backup-archive clients, which could allow malicious users to replace system files on the client with arbitrary content. Note: All Windows and NetWare backup-archive clients are unaffected.
Solution
Upgrade to fixed versions
http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg21454745
Vendor Information
IBM
http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg21454745
References
IBM
http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg21454745
VUPEN Security
http://www.vupen.com/english/advisories/2010/3251
SecurityTracker
http://securitytracker.com/alerts/2010/Dec/1024901.html
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|