IBM Tivoli Storage Manager Multiple Remote Vulnerabilities
BID:36916
Info
IBM Tivoli Storage Manager Multiple Remote Vulnerabilities
| Bugtraq ID: | 36916 |
| Class: | Unknown |
| CVE: |
CVE-2009-3853 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 04 2009 12:00AM |
| Updated: | Dec 28 2009 07:02PM |
| Credit: | Dyon Balding of Secunia Research and IBM |
| Vulnerable: |
IBM Tivoli Storage Manager 6.1 .1 IBM Tivoli Storage Manager 5.4.2 .4 IBM Tivoli Storage Manager 5.4.2 .3 IBM Tivoli Storage Manager 5.4.2 .2 IBM Tivoli Storage Manager 5.4.1 .2 Client IBM Tivoli Storage Manager 5.3.6 .6 Express IBM Tivoli Storage Manager 5.3.6 .2 IBM Tivoli Storage Manager 5.3.6 .1 IBM Tivoli Storage Manager 5.3.5 .3 Client IBM Tivoli Storage Manager 5.3.4 IBM Tivoli Storage Manager 6.1 IBM Tivoli Storage Manager 5.4.2.7 IBM Tivoli Storage Manager 5.4 Client IBM Tivoli Storage Manager 5.4 IBM Tivoli Storage Manager 5.3.6.6 IBM Tivoli Storage Manager 5.3.5.1 Client IBM Tivoli Storage Manager 5.3.5.1 IBM Tivoli Storage Manager 5.3.2.4 Client IBM Tivoli Storage Manager 5.3.2.4 IBM Tivoli Storage Manager 5.3 Express IBM Tivoli Storage Manager 5.3 Client IBM Tivoli Storage Manager 5.3 |
| Not Vulnerable: |
IBM Tivoli Storage Manager 6.1 .2 IBM Tivoli Storage Manager 5.4.3 IBM Tivoli Storage Manager 5.3.6 .9 Express IBM Tivoli Storage Manager 5.3.6 .7 |
Discussion
IBM Tivoli Storage Manager Multiple Remote Vulnerabilities
IBM Tivoli Storage Manager is prone to multiple buffer-overflow issues and an unauthorized-access issue.
Attackers can exploit these issues to cause a denial-of-service condition, to execute arbitrary code, and to read, copy, edit, or delete files on a victim's computer. Other attacks may also be possible.
IBM Tivoli Storage Manager is prone to multiple buffer-overflow issues and an unauthorized-access issue.
Attackers can exploit these issues to cause a denial-of-service condition, to execute arbitrary code, and to read, copy, edit, or delete files on a victim's computer. Other attacks may also be possible.
Exploit / POC
IBM Tivoli Storage Manager Multiple Remote Vulnerabilities
Note that the unauthorized-access issue may be exploited through filesystem utilities and may not require exploit code.
The following Metasploit exploit module is available:
Note that the unauthorized-access issue may be exploited through filesystem utilities and may not require exploit code.
The following Metasploit exploit module is available:
Solution / Fix
IBM Tivoli Storage Manager Multiple Remote Vulnerabilities
Solution:
Vendor updates are available. Please see the references for details.
Solution:
Vendor updates are available. Please see the references for details.
References
IBM Tivoli Storage Manager Multiple Remote Vulnerabilities
References:
References: