PT-2006-6528 · Ibm · Ibm Tivoli Storage Manager

Publicado 2006-12-06 · Atualizado 2018-10-17 · CVE-2006-5855

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager (TSM) versions prior to 5.2.9 IBM Tivoli Storage Manager (TSM) versions 5.3.x prior to 5.3.4

Description The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in several fields. This includes the language field at logon that begins with a 0x18 byte, two unspecified parameters to the SmExecuteWdsfSession function, and the contact field in an open registration message.

Recommendations For IBM Tivoli Storage Manager (TSM) versions prior to 5.2.9, update to version 5.2.9 or later. For IBM Tivoli Storage Manager (TSM) versions 5.3.x prior to 5.3.4, update to version 5.3.4 or later. As a temporary workaround, consider restricting access to the SmExecuteWdsfSession function and limiting the length of input in the language and contact fields to prevent exploitation.

Correção

Identificadores relacionados

CVE-2006-5855

Produtos afetados

Ibm Tivoli Storage Manager

Referências · 16

• http://securityreason.com/securityalert/1979 · Nota
• http://kb.cert.org/vuls/id/478753 · Nota
• http://vupen.com/english/advisories/2006/4856 · Nota
• http://tippingpoint.com/security/advisories/TSRT-06-14.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30702 · Nota
• http://kb.cert.org/vuls/id/887249 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30701 · Nota
• http://securityfocus.com/bid/21440 · Aviso do Fabricante
• http://secunia.com/advisories/23177 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=swg21250261 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30699 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5855 · Nota de Segurança
• http://securityfocus.com/archive/1/453544/100/0/threaded · Nota
• http://kb.cert.org/vuls/id/350625 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg1IC50347 · Aviso do Fabricante