IBM Tivoli Storage Manager Client Multiple Remote Vulnerabilities

Bugtraq ID:	45401
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Dec 15 2010 12:00AM
Updated:	Dec 16 2010 03:14PM
Credit:	Kryptos Logic and the vendor reported this issue.
Vulnerable:	IBM IBM Tivoli Storage Manager Client 6.2.1.1 IBM IBM Tivoli Storage Manager Client 6.2.0.0 IBM IBM Tivoli Storage Manager Client 6.1.3.4 IBM IBM Tivoli Storage Manager Client 6.1.3.0 IBM IBM Tivoli Storage Manager Client 6.1.0.0 IBM IBM Tivoli Storage Manager Client 5.5.2.7 IBM IBM Tivoli Storage Manager Client 5.5.2.12 IBM IBM Tivoli Storage Manager Client 5.5.0.0 IBM IBM Tivoli Storage Manager Client 5.4.3.3 IBM IBM Tivoli Storage Manager Client 5.4.0.0 IBM IBM Tivoli Storage Manager Client 5.3.6.7 IBM IBM Tivoli Storage Manager Client 5.3.0.0
Not Vulnerable:	IBM IBM Tivoli Storage Manager Client 6.2.2 IBM IBM Tivoli Storage Manager Client 6.1.4 IBM IBM Tivoli Storage Manager Client 5.5.3 IBM IBM Tivoli Storage Manager Client 5.4.3.4 IBM IBM Tivoli Storage Manager Client 5.3.6.10

IBM Tivoli Storage Manager Client Multiple Remote Vulnerabilities

IBM Tivoli Storage Manager Client is prone to multiple vulnerabilities.

Local attackers can exploit these issues to gain elevated privileges or overwrite arbitrary files. Remote attackers may execute arbitrary code and read, copy, edit, or delete arbitrary files.

The following versions are vulnerable:

IBM Tivoli Storage Manager Client 6.2.0.0 through 6.2.1.1
IBM Tivoli Storage Manager Client 6.1.0.0 through 6.1.3.4
IBM Tivoli Storage Manager Client 5.5.0.0 through 5.5.2.12
IBM Tivoli Storage Manager Client 5.4.0.0 through 5.4.3.3
IBM Tivoli Storage Manager Client 5.3.0.0 through 5.3.6.7

IBM Tivoli Storage Manager Client Multiple Remote Vulnerabilities

The following exploit code is available:

• /data/vulnerabilities/exploits/45401.c
• /data/vulnerabilities/exploits/45401-1.c

IBM Tivoli Storage Manager Client Multiple Remote Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.

IBM Tivoli Storage Manager Client Multiple Remote Vulnerabilities

References:

• IBM Tivoli Storage Manager (TSM) Client 5.5.3 Downloads and READMEs (IBM)
  
• IBM Tivoli Storage Manager (TSM) Client 6.1.4 Downloads and READMEs (IBM)
  
• IBM Tivoli Storage Manager (TSM) Client 6.2.2 Downloads and READMEs (IBM)
  
• IBM Tivoli Storage Manager (TSM) client V5.4.3.x interim fix downloads (IBM)
  
• IBM Tivoli Storage Manager (TSM) Local Stack Overflow (Kryptos Logic)
  
• TSM UNIX and Linux Client Security Fixes - December 2010 (IBM)