Vulnerability CVE-2009-1178 - CERT Civis.Net

Vulnerability Name:

CVE-2009-1178 (CCN-49533)

Assigned:

2009-03-27

Published:

2009-03-27

Updated:

2009-04-01

Summary:

Unspecified vulnerability in the server in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.2 and 6.x before 6.1 has unknown impact and attack vectors related to the "admin command line."

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

1.9 Low (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N)
1.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Other

References:

Source: MITRE
Type: CNA
CVE-2009-1178

Source: CCN
Type: SA34498
IBM Tivoli Storage Manager Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
34498

Source: CCN
Type: SECTRACK ID: 1021945
IBM Tivoli Storage Manager Administrative Command Line Bug Has Unspecified Impact

Source: SECTRACK
Type: UNKNOWN
1021945

Source: CONFIRM
Type: Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21246076

Source: CCN
Type: IBM Technote (FAQ) 1375360
APARs Fixed in Tivoli Storage Manager Server Version 6.1

Source: CONFIRM
Type: UNKNOWN
http://www-01.ibm.com/support/docview.wss?uid=swg21375360

Source: AIXAPAR
Type: UNKNOWN
IC46744

Source: CCN
Type: OSVDB ID: 53428
IBM Tivoli Storage Manager (TSM) Admin Command Line Unspecified Issue

Source: BID
Type: UNKNOWN
34285

Source: CCN
Type: BID-34285
IBM Tivoli Storage Manager Multiple Vulnerabilities

Source: VUPEN
Type: Vendor Advisory
ADV-2009-0881

Source: XF
Type: UNKNOWN
tsm-admin-cmdline-unspecified(49533)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:tivoli_storage_manager:5.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:6.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:tivoli_storage_manager:-:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:4.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:4.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.1.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.2.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.2.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.2.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.2.9:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.4.4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.4.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.4.2.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.4.2.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.2.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.2.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.2.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager:5.3.2.4:*:*:*:*:*:*:*

Denotes that component is vulnerable