IBM Spectrum Protect CVE-2016-8939 Local Information Disclosure Vulnerability

Bugtraq ID:	98783
Class:	Design Error
CVE:	CVE-2016-8939
Remote:	No
Local:	Yes
Published:	May 31 2017 12:00AM
Updated:	May 31 2017 12:00AM
Credit:	Kestutis Gudinavicius from SEC Consult and Jakob H. Heidelberg & Flemming Riis at Improsec ApS
Vulnerable:	IBM Tivoli Storage Manager 6.2.5 IBM Tivoli Storage Manager 6.2.4 IBM Tivoli Storage Manager 6.2.2 IBM Tivoli Storage Manager 6.2.1 IBM Tivoli Storage Manager 6.1 .2 IBM Tivoli Storage Manager 6.1 .1 IBM Tivoli Storage Manager 5.3.6 .7 IBM Tivoli Storage Manager 5.3.6 .2 IBM Tivoli Storage Manager 5.3.6 .1 IBM Tivoli Storage Manager 7.1.7.000 IBM Tivoli Storage Manager 7.1.5 IBM Tivoli Storage Manager 7.1.4.3 IBM Tivoli Storage Manager 7.1.4 IBM Tivoli Storage Manager 7.1.3 IBM Tivoli Storage Manager 7.1.0.000 IBM Tivoli Storage Manager 7.1.0 IBM Tivoli Storage Manager 7.1 IBM Tivoli Storage Manager 6.4.2.400 IBM Tivoli Storage Manager 6.4.2.2 IBM Tivoli Storage Manager 6.4.1.000 IBM Tivoli Storage Manager 6.4 IBM Tivoli Storage Manager 6.3.6 IBM Tivoli Storage Manager 6.3.5.1 IBM Tivoli Storage Manager 6.3.5.0 IBM Tivoli Storage Manager 6.3.4 IBM Tivoli Storage Manager 6.3.3 IBM Tivoli Storage Manager 6.3.0 IBM Tivoli Storage Manager 6.3 IBM Tivoli Storage Manager 6.2.1.0 IBM Tivoli Storage Manager 6.2 IBM Tivoli Storage Manager 6.1.5.300 IBM Tivoli Storage Manager 6.1.5.200 IBM Tivoli Storage Manager 6.1.5.2 IBM Tivoli Storage Manager 6.1.5.10 IBM Tivoli Storage Manager 6.1 IBM Tivoli Storage Manager 6.0 IBM Tivoli Storage Manager 5.3.6.6 IBM Spectrum Protect 8.1.1 IBM Spectrum Protect 8.1
Not Vulnerable:

IBM Spectrum Protect CVE-2016-8939 Local Information Disclosure Vulnerability

IBM Spectrum Protect is prone to local information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

The follwing products are vulnerable:

IBM Spectrum Protect 8.1.x
Tivoli Storage Manager 7.1.x
Tivoli Storage Manager 6.4.x
Tivoli Storage Manager 6.3.x

IBM Spectrum Protect CVE-2016-8939 Local Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

IBM Spectrum Protect CVE-2016-8939 Local Information Disclosure Vulnerability

References:

• IBM Homepage (IBM)
  
• Controlling access to Windows registry entries for IBM Spectrum Protect (IBM)
  
• IBM Spectrum Protect Windows Client password exposure (CVE-2016-8939) (IBM)