IBM Spectrum Protect CVE-2017-1301 Insecure Temporary File Creation Vulnerability

Bugtraq ID:	101107
Class:	Design Error
CVE:	CVE-2017-1301
Remote:	No
Local:	Yes
Published:	Oct 02 2017 12:00AM
Updated:	Oct 02 2017 12:00AM
Credit:	IBM.
Vulnerable:	IBM Spectrum Protect 8.1.1 IBM Spectrum Protect 8.1.0.2 IBM Spectrum Protect 8.1 IBM Spectrum Protect 7.1.6.7 IBM Spectrum Protect 7.1.6.6 IBM Spectrum Protect 7.1
Not Vulnerable:

IBM Spectrum Protect CVE-2017-1301 Insecure Temporary File Creation Vulnerability

IBM Spectrum Protect is prone to a security vulnerability because it creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files on the system with elevated privileges.

IBM Spectrum Protect CVE-2017-1301 Insecure Temporary File Creation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Spectrum Protect CVE-2017-1301 Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Spectrum Protect CVE-2017-1301 Insecure Temporary File Creation Vulnerability

References:

• IBM Homepage (IBM)
  
• swg22006248:IBM Spectrum Protect (formerly Tivoli Storage Manager) Unix Clients (IBM)