PT-2017-9883 · Ibm · Ibm Tivoli Storage Manager

Kęstutis Gudinavičius · Published 2017-10-05 · Updated 2017-10-25 · CVE-2016-8937

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager versions 7.1 and 8.1

Description The default authentication protocol of the IBM Tivoli Storage Manager is susceptible to a brute force attack due to the disclosure of excessive information during the authentication process. This could allow an attacker to obtain user or administrative access to the TSM server.

Recommendations For versions 7.1 and 8.1, consider changing the default authentication protocol to a more secure alternative to mitigate the risk of brute force attacks. As a temporary workaround, restrict access to the TSM server and limit the number of authentication attempts to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2016-8937

Affected Products

Ibm Tivoli Storage Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8937 · Security Note
• http://ibm.com/support/docview.wss?uid=swg22007935 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8937 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/118750 · Vendor Advisory