Security Bulletin: Privilege escalation and code injection vulnerabilities in IBM Spectrum Protect Plus application protection (CVE-2019-4383, CVE-2019-4357)

Summary IBM Spectrum Protect Plus application protection could allow a local attacker to gain elevated privileges or execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2019-4383 DESCRIPTION: When using Spectrum Protect Plus to protect Oracle or MongoDB databases, a redirected...

Security Bulletin: Speculative Store Bypass (SSB) vulnerability also known as SpectreNG or Variant 4 affects IBM Spectrum Protect Plus (CVE-2018-3639)

Summary IBM Spectrum Protect Plus may be affected by the Speculative Storage Bypass SSB vulnerability which is also known as SpetreNG or Variant 4. Vulnerability Details CVEID: CVE-2018-3639 DESCRIPTION: Multiple Intel CPU''s could allow a local attacker to obtain sensitive information, caused by...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0739, CVE-2018-0737, CVE-2018-0732)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on March 27, 2018, April 16, 2018, and June 12, 2018. OpenSSL, used by IBM Spectrum Protect Plus, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of...

CVE-2019-4385

IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...

Information disclosure

IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...

CVE-2019-4385

IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...

CVE-2019-4385

IBM Spectrum Protect Plus 10.1.2 is affected by CVE-2019-4385, where the vSnap CIFS password can be exposed in the IBM Spectrum Protect Plus Joblog, leading to information disclosure of sensitive data and potentially access to vSnap. Affected versions are 10.1.2.219 through 10.1.2.303. The root c...

Security Bulletin: Password exposure via job log in IBM Spectrum Protect Plus (CVE-2019-4385)

Summary IBM Spectrum Protect Plus may display the vSNAP CIFS password in the Spectrum Protect Plus job log Vulnerability Details CVEID: CVE-2019-4385 DESCRIPTION: IBM Spectrum Protect Plus may display the vSnap CIFS password in the IBM Spectrum Protect Plus job log. This can result in an attacker...

Security Bulletin: Multiple Samba vulnerabilities affect IBM Spectrum Protect Plus (CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919)

Summary There are multiple security vulnerabilities in Samba that affect IBM Spectrum Protect Plus. These vulnerabilities may result in potential information disclosure, denial of service, or execution of arbitrary code on the system. Vulnerability Details CVEID: CVE-2018-1139 DESCRIPTION: Samba...

Security Bulletin: Multiple vulnerabilities in Oracle Java SE affect IBM Spectrum Protect Plus (CVE-2018-3136, CVE-2018-3139, CVE-2018-3149, CVE-2018-3169, CVE-2018-3180, CVE-2018-3183, CVE-2018-3214, CVE-2018-13785)

Summary There are multiple vulnerabilities in Oracle Java SE which is used by IBM Spectrum Protect™ Plus. These issues were disclosed as part of the Oracle Critical Patch Update CPU in October 2018. Vulnerability Details CVEID: CVE-2018-3136 DESCRIPTION: An unspecified vulnerability in Oracle Jav...

CVE-2018-1768

IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may be displayed in plain text within an instrumentation log file. IBM X-Force ID: 148622...

Default credentials

IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may be displayed in plain text within an instrumentation log file. IBM X-Force ID: 148622...

CVE-2018-1768

IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may be displayed in plain text within an instrumentation log file. IBM X-Force ID: 148622...

CVE-2018-1768

IBM Spectrum Protect Plus 10.1.0 and 10.1.1 are affected by CVE-2018-1768, which can disclose user IDs and passwords in plain text within an instrumentation log file when an authorized user runs a test operation. The root cause is sensitive credentials being written to logs. Affected platforms in...

Security Bulletin: Password disclosure via instrumentation log file in IBM Spectrum Protect Plus (CVE-2018-1768)

Summary IBM Spectrum Protect Plus may display the user id and password in plain text within the instrumentation log file. Vulnerability Details CVEID: CVE-2018-1768 DESCRIPTION: IBM Spectrum Protect Plus could disclose sensitive information when an authorized user executes a test operation, the...

Security Bulletin: PostgreSQL vulnerability affects IBM Spectrum Protect Plus (CVE-2017-15097)

Summary A vulnerability in PostgreSQL affects IBM Spectrum Protect™ Plus. This vulnerability could result in a local authenticated attacker gaining elevated privileges on the system. Vulnerability Details CVEID: CVE-2017-15097 DESCRIPTION: PostgreSQL could allow a local authenticated attacker to...

Security Bulletin: Multiple vulnerabilities in Oracle Java SE affect IBM Spectrum Protect Plus

Summary There are multiple vulnerabilities in Oracle Java SE which is used by IBM Spectrum Protect™ Plus. These issues were disclosed as part of the Oracle Critical Patch Update CPU in April 2018 and July 2018. Vulnerability Details CVEID: CVE-2018-2783 DESCRIPTION: An unspecified vulnerability i...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2017-3736, CVE-2017-3737, CVE-2017-3738)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on November 2, 2017 and December 7, 2017. OpenSSL, used by the IBM Spectrum Protect Plus, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-3736 DESCRIPTION: OpenSSL could allow a remote attacker to obtai...

Security Bulletin: OpenSSH vulnerability affects IBM Spectrum Protect Plus (CVE-2017-15906)

Summary OpenSSH is vulnerable to a denial of service vulnerability which affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2017-15906 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by an error in the processopen function when in read-only mode. A remote...

Security Bulletin: Apache Commons FileUpload vulnerability affects IBM Spectrum Protect Plus (CVE-2016-1000031)

Summary A vulnerability in Apache Commons FileUpload affects IBM Spectrum Protect™ Plus. This vulnerability could allow an attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in Novell NetIQ Sentinel and...