Security Bulletin: Password disclosure in IBM Spectrum Protect Server (CVE-2019-4140)

Summary

The IBM Spectrum Protect (formerly Tivoli Storage Manager) Server may disclose the database restore password when using the dsmserv restore db command. This could allow another user to perform a database restore or possibly result in an old backup replacing the database.

Vulnerability Details

CVEID: CVE-2019-4140 DESCRIPTION: IBM Tivoli Storage Manager Server could allow a local user to replace existing databases by restoring old data.
CVSS Base Score: 6.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/158336&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

This vulnerability affects the following IBM Spectrum Protect (formerly Tivoli Storage Manager) Server levels:

• 8.1.0.0 through 8.1.7.xxx
• 7.1.0.0 through 7.1.9.200

Remediation/Fixes

This vulnerability is resolved by applying the First Fixing VRM Level (or higher) as noted in the following table and by not specifying the PASSWORD parameter when using the dsmserv restore db command. When the PASSWORD parameter is not specified, the IBM Spectrum Protect Server will prompt for the password used to protect the database backup.

IBM Spectrum Protect
Server Release | First Fixing
VRM Level | Platform | Link to Fix
—|—|—|—
8.1 | 8.1.8 | AIX
Linux
Windows |

<https://www.ibm.com/support/docview.wss?uid=ibm10888463&gt;

7.1 | 7.1.9.300 | AIX
HP-UX
Linux
Solaris
Windows |

<ftp://public.dhe.ibm.com/storage/tivoli-storage-management/patches/server/&gt;

Workarounds and Mitigations

None