PT-2015-1399 · Ibm · Ibm Tivoli Storage Manager Fastback

Lola Montez · Published 2015-06-30 · Updated 2016-12-28 · CVE-2015-1942

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager FastBack versions prior to 6.1.12

Description The issue allows remote attackers to write to and execute arbitrary files by sending crafted TCP packets to an unspecified port. This is due to insufficient input validation in the program. An attacker can exploit this to read and execute arbitrary files.

Recommendations For versions prior to 6.1.12, update to version 6.1.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-10494

CVE-2015-1942

ZDI-15-269

Affected Products

Ibm Tivoli Storage Manager Fastback

References · 7

• http://www-01.ibm.com/support/docview.wss?uid=swg21959398 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-15-269 · Security Note
• https://bdu.fstec.ru/vul/2015-10494 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1942 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-15-269 · Note
• http://securityfocus.com/bid/75450 · Note
• http://securitytracker.com/id/1032773 · Note