PT-2009-1252 · Ibm · Ibm Tsm Express+1
Publicado
2009-05-05
·
Atualizado
2018-10-11
·
CVE-2008-4828
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
IBM Tivoli Storage Manager (TSM) client versions 5.1.0.0 through 5.1.8.2
IBM Tivoli Storage Manager (TSM) client versions 5.2.0.0 through 5.2.5.3
IBM Tivoli Storage Manager (TSM) client versions 5.3.0.0 through 5.3.6.4
IBM Tivoli Storage Manager (TSM) client versions 5.4.0.0 through 5.4.1.96
IBM TSM Express client versions 5.3.3.0 through 5.3.6.4
Description
The issue is related to multiple stack-based buffer overflows in the dsmagent.exe component of the Remote Agent Service. This can be exploited by remote attackers to execute arbitrary code through either a request packet that is not properly parsed by a generic string handling function or a crafted NodeName in a dicuGetIdentifyRequest request packet. The vulnerability is associated with both the Web GUI and Java GUI components.
Recommendations
For IBM Tivoli Storage Manager (TSM) client versions 5.1.0.0 through 5.1.8.2, update to a version outside of this range.
For IBM Tivoli Storage Manager (TSM) client versions 5.2.0.0 through 5.2.5.3, update to a version outside of this range.
For IBM Tivoli Storage Manager (TSM) client versions 5.3.0.0 through 5.3.6.4, update to a version outside of this range.
For IBM Tivoli Storage Manager (TSM) client versions 5.4.0.0 through 5.4.1.96, update to a version outside of this range.
For IBM TSM Express client versions 5.3.3.0 through 5.3.6.4, update to a version outside of this range.
As a temporary workaround, consider restricting access to the
dsmagent.exe component until a patch is available.Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ibm Tsm Express
Ibm Tivoli Storage Manager