Vulnerability CVE-2009-1520 - CERT Civis.Net

Vulnerability Name:

CVE-2009-1520 (CCN-50328)

Assigned:

2009-04-05

Published:

2009-04-05

Updated:

2017-08-17

Summary:

Buffer overflow in the Web GUI in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 through 5.1.8.2, 5.2.0.0 through 5.2.5.3, 5.3.0.0 through 5.3.6.4, 5.4.0.0 through 5.4.2.6, and 5.5.0.0 through 5.5.1.17 allows attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-1520

Source: CCN
Type: SA32604
IBM Tivoli Storage Manager Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
32604

Source: CCN
Type: SA35124
IBM Tivoli Storage Manager Client Multiple Vulnerabilities

Source: CCN
Type: IBM Support & downloads
Security fixes for the IBM Tivoli Storage Manager (TSM) client

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21384389

Source: AIXAPAR
Type: Vendor Advisory
IC59994

Source: CCN
Type: OSVDB ID: 54233
IBM Tivoli Storage Manager (TSM) Agent Client (dsmagent.exe) WebGUI Unspecified Overflow

Source: CCN
Type: BID-34803
IBM Tivoli Storage Manager Multiple Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2009-1235

Source: XF
Type: UNKNOWN
ibm-tsm-webgui-bo(50328)

Source: XF
Type: UNKNOWN
ibm-tsm-webgui-bo(50328)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:tivoli_storage_manager_client:5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.1.8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.1.8.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4.1.96:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_express:5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_express:5.3.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_express:5.3.6.4:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:tivoli_storage_manager_client:5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.1.8.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2.5.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4.1.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_express:5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2.5.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.1.8.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.2.5.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.3.6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_client:5.4.1.96:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_express:5.3.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_storage_manager_express:5.3.6.4:*:*:*:*:*:*:*

Denotes that component is vulnerable