CVE-2013-3976

2014-03-2610:55:05

CWE-264

[email protected]

web.nvd.nist.gov

ibm

tivoli

storage manager

flashcopy

unauthorized access

pst restore

security vulnerability

2.1 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

6.1 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

45.5%

JSON

The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) FlashCopy Manager for Exchange component 2.2 and 3.1 before 3.1.1 in IBM Tivoli Storage FlashCopy Manager do not properly constrain mailbox contents during certain PST restore operations, which allows remote authenticated users to read the personal e-mail of other users in opportunistic circumstances by launching an e-mail client after an administrator performs a multiple-mailbox restore.

Affected configurations

NVD

Node

ibmdata_protectionMatch6.1exchange_server

ibmdata_protectionMatch6.3exchange_server

ibmflashcopy_managerMatch2.1exchange_server

ibmflashcopy_managerMatch2.2exchange_server

ibmflashcopy_managerMatch3.1exchange_server

ibmtivoli_storage_flashcopy_managerMatch-

ibmtivoli_storage_manager_for_mailMatch-

CPENameOperatorVersion
ibm:data_protectionibm data protectioneq6.1
ibm:data_protectionibm data protectioneq6.3
ibm:flashcopy_manageribm flashcopy managereq2.1
ibm:flashcopy_manageribm flashcopy managereq2.2
ibm:flashcopy_manageribm flashcopy managereq3.1
ibm:tivoli_storage_flashcopy_manageribm tivoli storage flashcopy managereq-
ibm:tivoli_storage_manager_for_mailibm tivoli storage manager for maileq-

CPE	Name	Operator	Version
ibm:data_protection	ibm data protection	eq	6.1
ibm:data_protection	ibm data protection	eq	6.3
ibm:flashcopy_manager	ibm flashcopy manager	eq	2.1
ibm:flashcopy_manager	ibm flashcopy manager	eq	2.2
ibm:flashcopy_manager	ibm flashcopy manager	eq	3.1
ibm:tivoli_storage_flashcopy_manager	ibm tivoli storage flashcopy manager	eq	-
ibm:tivoli_storage_manager_for_mail	ibm tivoli storage manager for mail	eq	-