PT-2010-5313 · Ibm+1 · Ibm Tivoli Provisioning Manager For Os Deployment+1

Abdulaziz Hariri · Published 2010-10-28 · Updated 2024-08-07 · CVE-2010-4121

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Tivoli Provisioning Manager for OS Deployment version 7.1.1.3

Description The TCP-to-ODBC gateway does not require authentication for SQL statements, allowing remote attackers to modify, create, or read database records via a session on TCP port 2020. The vendor disputes this issue, stating that the default Microsoft Access database is not password protected because it is intended to be used for evaluation purposes only.

Recommendations For IBM Tivoli Provisioning Manager for OS Deployment version 7.1.1.3, consider restricting access to TCP port 2020 to minimize the risk of exploitation. As a temporary workaround, restrict the use of the TCP-to-ODBC gateway until a patch is available or additional security measures are implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-4121

Affected Products

Ibm Tivoli Provisioning Manager For Os Deployment

Access

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-4121 · Security Note
• https://t.me/cvenotify/89552 · Telegram Post
• http://securitytracker.com/id?1024539 · Note
• http://zerodayinitiative.com/advisories/ZDI-10-194 · Note
• http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=%2Fcom.ibm.tivoli.tpm.osd.doc%2Finstall%2Ftosd_setmsacessdbpwd.html · Note