IBM System Storage TS3100 and TS3200 Tape Library Express Security Bypass Vulnerability

Bugtraq ID:	50799
Class:	Design Error
CVE:	CVE-2011-1372
Remote:	Yes
Local:	No
Published:	Nov 24 2011 12:00AM
Updated:	Dec 20 2011 11:19PM
Credit:	Martin Murfitt of Trustwave's SpiderLabs
Vulnerable:	IBM System Storage TS3200 Tape Library Express A.59 IBM System Storage TS3100 Tape Library Express A.59
Not Vulnerable:	IBM System Storage TS3200 Tape Library Express A.60 IBM System Storage TS3100 Tape Library Express A.60

IBM System Storage TS3100 and TS3200 Tape Library Express Security Bypass Vulnerability

IBM System Storage TS3100 and TS3200 Tape Library Express are prone to a security-bypass vulnerability.

Successful exploits may allow attackers to bypass security restrictions and give access to the library administration.

IBM System Storage TS3100 and TS3200 Tape Library Express versions prior to A.60 are vulnerable.

IBM System Storage TS3100 and TS3200 Tape Library Express Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM System Storage TS3100 and TS3200 Tape Library Express Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

IBM System Storage TS3100 and TS3200 Tape Library Express Security Bypass Vulnerability

References:

• Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could a (IBM)
  
• Trustwave's SpiderLabs Security Advisory TWSL2011-018: Authentication Bypass Vul (Trustwave's SpiderLabs)
  
• TS3100 Tape Library Express Model (IBM)
  
• TS3200 Tape Library Express Model (IBM)