PT-2014-2919 · Microsoft+1 · Windows+2

Published 2014-01-23 · Updated 2017-08-29 · CVE-2013-5371

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager (TSM) versions 6.3.1 through 6.4.0

Description The issue concerns the client in IBM Tivoli Storage Manager (TSM) on Windows, where it fails to preserve permissions of Resilient File System (ReFS) files during backup and restore operations. This allows local users to bypass intended access restrictions through standard filesystem operations.

Recommendations For versions 6.3.1 and 6.4.0, update to a version that preserves file permissions across backup and restore operations to prevent access restriction bypass.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-5371

Affected Products

Ibm Tivoli Storage Manager

Refs

Windows

References · 4

• http://ibm.com/support/docview.wss?uid=swg21662608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5371 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC92933 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86661 · Note