PT-2015-1391 · Ibm · Ibm Tivoli Storage Manager Fastback

Brian Gorenc · Published 2015-06-30 · Updated 2016-12-28 · CVE-2015-1949

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager FastBack versions 6.1 through 6.1.11

Description The issue is related to a lack of input sanitization in the Tivoli Storage Manager FastBack program, which can be exploited by a remote attacker to execute arbitrary code with system privileges. The exploitation allows attackers to execute arbitrary commands with SYSTEM privileges.

Recommendations For IBM Tivoli Storage Manager FastBack versions 6.1 through 6.1.11, update to version 6.1.12 or later to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2015-10486

CVE-2015-1949

ZDI-15-271

Affected Products

Ibm Tivoli Storage Manager Fastback

References · 7

• http://www-01.ibm.com/support/docview.wss?uid=swg21959398 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10486 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-271 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1949 · Security Note
• http://securityfocus.com/bid/75459 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-271 · Note
• http://securitytracker.com/id/1032773 · Note