Security Bulletin: A security vulnerability has been identified in IBM Tivoli Storage Manager that affects multiple IBM Tivoli Storage products (CVE-2016-0371)

Summary

The IBM Tivoli Storage Manger Client/API is used as a component of IBM Tivoli Storage FlashCopy Manager for Windows, IBM Tivoli Storage Manager HSM for Windows, IBM Tivoli Storage Manager for Databases, IBM Tivoli Storage Manager for Mail, and IBM Tivoli Storage Manager for Virtual Environments. Information about a security vulnerability affecting the IBM Tivoli Manager Client/API has been published in a security bulletin.

Vulnerability Details

Consult the security bulletin Password Disclosure via application tracing in IBM Tivoli Storage Manager Client (CVE-2016-0371)for vulnerability details and information about the fixes

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Tivoli Storage FlashCopy Manager (IBM Spectrum Protect Snapshot) for Windows version 4.1| Tivoli Storage Manager Client/API version 7.1
IBM Tivoli Storage FlashCopy Manager for Windows version 3.2| Tivoli Storage Manager Client/API version 6.4
IBM Tivoli Storage FlashCopy Manager for Windows version 3.1| Tivoli Storage Manager Client/API version 6.3
Note: Within the Tivoli Storage FlashCopy Manager on Windows product, the Tivoli Storage Manager client is also referred to as the FlashCopy Manager VSS Requestor component.

Remediation/Fixes

Refer to the security bulletin Password Disclosure via application tracing in IBM Tivoli Storage Manager Client (CVE-2016-0371)

Workarounds and Mitigations

Refer to the security bulletin Password Disclosure via application tracing in IBM Tivoli Storage Manager Client (CVE-2016-0371)