PT-2016-1112 · Ibm · Tivoli Storage Flashcopy Manager For Vmware+1

Published 2016-01-02 · Updated 2016-01-07 · CVE-2015-7426

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware versions 7.1 through 7.1.3.0 Tivoli Storage FlashCopy Manager for VMware versions 4.1 through 4.1.3.0

Description The issue allows remote attackers to execute arbitrary OS commands. This is due to the failure to neutralize special elements used in the operating system command. The exploitation of this issue can allow a remote attacker to execute arbitrary operating system commands.

Recommendations For IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware versions 7.1 through 7.1.3.0, update to version 7.1.3.0 or later. For Tivoli Storage FlashCopy Manager for VMware versions 4.1 through 4.1.3.0, update to version 4.1.3.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2016-00357

CVE-2015-7426

Affected Products

Ibm Tivoli Storage Manager For Virtual Environments: Data Protection For Vmware

Tivoli Storage Flashcopy Manager For Vmware

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21971484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7426 · Security Note
• https://bdu.fstec.ru/vul/2016-00357 · Security Note