PT-2007-3215 · Ibm · Ibm Tivoli Provisioning Manager For Os Deployment

Published 2007-04-04 · Updated 2017-07-29 · CVE-2007-1868

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM Tivoli Provisioning Manager for OS Deployment versions prior to 5.1 Fix Pack 2

Description: The management service does not properly handle multipart/form-data in HTTP POST requests, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted POST requests to port 8080/tcp or 443/tcp.

Recommendations: For versions prior to 5.1 Fix Pack 2, update to 5.1 Fix Pack 2 or later to resolve the issue. As a temporary workaround, consider restricting access to the management service on ports 8080/tcp and 443/tcp to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-1868

Affected Products

Ibm Tivoli Provisioning Manager For Os Deployment

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ibm_tpmfosd_overflow.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16810 · Exploit
• http://www-1.ibm.com/support/docview.wss?uid=swg24015347 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-1868 · Security Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=498 · Vendor Advisory
• http://secunia.com/advisories/24717 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33384 · Note
• http://securitytracker.com/id?1017840 · Note
• http://securityfocus.com/bid/23264 · Note
• http://vupen.com/english/advisories/2007/1199 · Note