IBM Tivoli Storage Manager Multiple Vulnerabilities

Bugtraq ID:	34803
Class:	Unknown
CVE:	CVE-2008-4828 CVE-2009-1520 CVE-2009-1521 CVE-2009-1522
Remote:	Yes
Local:	No
Published:	May 04 2009 12:00AM
Updated:	Dec 21 2009 10:43AM
Credit:	Dyon Balding of Secunia Research and IBM
Vulnerable:	IBM Tivoli Storage Manager 5.5.1 .6 IBM Tivoli Storage Manager 5.5.1 .0 IBM Tivoli Storage Manager 5.5 .7 IBM Tivoli Storage Manager 5.4.2 .4 IBM Tivoli Storage Manager 5.4.2 .3 IBM Tivoli Storage Manager 5.4.2 .2 IBM Tivoli Storage Manager 5.4.1 .2 Client IBM Tivoli Storage Manager 5.3.6 .9 Express IBM Tivoli Storage Manager 5.3.6 .2 Special IBM Tivoli Storage Manager 5.2.5 .3 IBM Tivoli Storage Manager 5.2.5 .2 IBM Tivoli Storage Manager 5.2.4 IBM Tivoli Storage Manager 5.2.3 .4 Client IBM Tivoli Storage Manager 5.5 Client IBM Tivoli Storage Manager 5.4 Client IBM Tivoli Storage Manager 5.4 IBM Tivoli Storage Manager 5.2 Client
Not Vulnerable:	IBM Tivoli Storage Manager 5.5.2 IBM Tivoli Storage Manager 6.1 IBM Tivoli Storage Manager 5.4.2.7 IBM Tivoli Storage Manager 5.3.6.6 Special IBM Tivoli Storage Manager 5.3.6.6 IBM Tivoli Storage Manager 5.2.5.4

IBM Tivoli Storage Manager Multiple Vulnerabilities

IBM Tivoli Storage Manager is prone to multiple vulnerabilities:

- Multiple buffer-overflow issues
- Multiple unauthorized-access issues

Attackers can exploit these issues to cause a denial-of-service condition, to execute arbitrary code, and to read, copy, edit, or delete files on a victim's computer. Other attacks may also be possible.

IBM Tivoli Storage Manager Multiple Vulnerabilities

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following Metasploit exploit module is available:

• /data/vulnerabilities/exploits/34803.rb

IBM Tivoli Storage Manager Multiple Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

IBM Tivoli Storage Manager Multiple Vulnerabilities

References:

• Secunia Research: IBM Tivoli Storage Manager Remote Agent Service Buffer Overflo (Secunia)
  
• Security fixes for the IBM Tivoli Storage Manager (TSM) client (IBM)
  
• IBM Tivoli Storage Manager (TSM) Client 6.1.0 Downloads (IBM)
  
• IBM Tivoli Storage Manager (TSM) Client V6.1 APAR fix list (IBM)
  
• IBM Tivoli Storage Manager Homepage (IBM)