PT-2015-1399 · Ibm · Ibm Tivoli Storage Manager Fastback

Lola Montez · Publicado 2015-06-30 · Atualizado 2016-12-28 · CVE-2015-1942

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager FastBack versions prior to 6.1.12

Description The issue allows remote attackers to write to and execute arbitrary files by sending crafted TCP packets to an unspecified port. This is due to insufficient input validation in the program. An attacker can exploit this to read and execute arbitrary files.

Recommendations For versions prior to 6.1.12, update to version 6.1.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-10494

CVE-2015-1942

ZDI-15-269

Produtos afetados

Ibm Tivoli Storage Manager Fastback

Referências · 7

• http://www-01.ibm.com/support/docview.wss?uid=swg21959398 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-15-269 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-269 · Nota de Segurança
• http://securityfocus.com/bid/75450 · Nota
• https://bdu.fstec.ru/vul/2015-10494 · Nota de Segurança
• http://securitytracker.com/id/1032773 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1942 · Nota de Segurança