IBM Tivoli Provisioning Manager TCP to ODBC Gateway Component SQL Injection Vulnerability

Bugtraq ID:	43896
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 08 2010 12:00AM
Updated:	Oct 08 2010 12:00AM
Credit:	AbdulAziz Hariri
Vulnerable:	IBM Tivoli Provisioning Manager for OS Deployment 5.1 3 Intirim Fix 3 IBM Tivoli Provisioning Manager for OS Deployment 5.1 .3 IBM Tivoli Provisioning Manager for OS Deployment 5.1 .116 IBM Tivoli Provisioning Manager for OS Deployment 5.1.Fix Pack 3 IBM Tivoli Provisioning Manager for OS Deployment 5.1.0.2
Not Vulnerable:

IBM Tivoli Provisioning Manager TCP to ODBC Gateway Component SQL Injection Vulnerability

IBM Tivoli Provisioning Manager is prone to a vulnerability that allows for the execution of arbitrary SQL commands.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

IBM Tivoli Provisioning Manager TCP to ODBC Gateway Component SQL Injection Vulnerability

An attacker can use readily available network utilities to exploit this issue.

IBM Tivoli Provisioning Manager TCP to ODBC Gateway Component SQL Injection Vulnerability

Solution:
The vendor released an update. Please see the references for details.

IBM Tivoli Provisioning Manager TCP to ODBC Gateway Component SQL Injection Vulnerability

References:

• Release Notes Version 7.1.1.3 (IBM)
  
• Tivoli Provisioning Manager for OS Deployment Product Page (IBM)
  
• ZDI-10-194: IBM Tivoli Provisioning Manager for OS Deployment TCP to ODBC Remote (Zero Day Initiative)