PT-2014-5604 · Rocket · Rocket Servergraph Admin Center For Tivoli Storage Manager

Andrea Micalizzi + 1 · Published 2014-06-02 · Updated 2014-06-12 · CVE-2014-3915

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rocket Servergraph Admin Center for Tivoli Storage Manager (affected versions not specified)

Description The issue concerns the userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph, which allows remote attackers to execute arbitrary commands. This can be achieved through various commands, including auth, auth session, auth simple, add, add flat, remove, set pwd, add permissions, revoke permissions, runAsync, or tsmRequest. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-3915

ZDI-14-164

Affected Products

Rocket Servergraph Admin Center For Tivoli Storage Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3915 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-14-164 · Security Note
• http://securityfocus.com/bid/67780 · Note
• http://zerodayinitiative.com/advisories/ZDI-14-164 · Note