IBM Spectrum Protect Plus Information Disclosure Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14212)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14208)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Security Bulletin: Command injection vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4210, CVE-2020-4213, CVE-2020-4222, CVE-2020-4212, CVE-2020-4211)

Summary Command injection vulnerabilities in IBM Spectrum Protect Plus could allow a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2020-4210 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to execute arbitrary code on the system. By...

Security Bulletin: Multiple vulnerabilities in Linux Kernel affect IBM Spectrum Protect Plus

Summary There are multiple security vulnerabilities in the Linux Kernel that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-19532 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by multiple out-of-bound write conditions in HID drivers. CVSS Base...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Plus (CVE-2019-4703)

Summary The user id and password may be exposed in IBM Spectrum Protect Plus when protecting Microsoft SQL or Microsoft Exchange. Vulnerability Details CVEID: CVE-2019-4703 DESCRIPTION: IBM Spectrum Protect Plus, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Protect Plus (CVE-2019-14833, CVE-2019-14847, CVE-2019-10218)

Summary Security vulnerabilities in Samba affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-14833 DESCRIPTION: A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new...

Security Bulletin: Vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus (CVE-2019-12402).

Summary A denial of service vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an error in the internal file name encoding algorithm. By choosi...

Security Bulletin: Multiple vulnerabilities in FasterXML Jackson-databind affect IBM Spectrum Protect Plus (CVE-2019-16943, CVE-2019-16942, CVE-2019-17531, CVE-2019-17267, CVE-2019-14540, CVE-2019-16335, CVE-2019-14379, CVE-2019-14439)

Summary There are multiple security vulnerabilities in FasterXML Jackson-databind that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-16943 DESCRIPTION: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0735, CVE-2018-0734, CVE-2018-5407)

Summary OpenSSL vulnerabilities were discllossed by the OpenSSL Project in October and November of 2018. IBM Spectrum Protect Plus uses OpenSSL and has addressed the applicable CVEs. 20 February 2020 - Changed fixing level from 10.1.5 to 10.1.5 patch1. 21 February 2020 - Provided link to 10.1.5...

Security Bulletin: A security vulnerability has been identified in the Linux Kernel that affects IBM Spectrum Protect Plus

Summary Information about a security vulnerability affecting the Linux Kernel has been published by the Zero Day Initiative. This vulnerability can affect IBM Spectrum Protect Plus. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products an...

The vulnerability of the IBM Spectrum Protect software server, which allows a intruder to gain unauthorized access to protected information.

The vulnerability of the IBM Spectrum Protect software platform’s data protection server is related to deficiencies in the storage of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect for Enterprise Resource Planning on AIX (CVE-2019-4473, CVE-2019-11771)

Summary Multiple vulnerabilities in IBM Runtime Environment Java were disclosed as part of the IBM Java SDK updates in July 2019. IBM Runtime Environment Java is used by IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning on AIX. Vulnerability Details CVEID:...

Security Bulletin: Denial of Service vulnerability in WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center (CVE-2019-4096)

Summary IBM WebSphere Application Server Liberty is vulnerable to a denial of service which can affect IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center. Vulnerability Details CVEID: CVE-2019-4046 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is...

Security Bulletin: Denial of Service vulnerability in IBM Spectrum Protect Backup-Archive Client (CVE-2019-4406)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client is vulnerable to a denial of service attack. Vulnerability Details CVEID: CVE-2019-4406 DESCRIPTION: The IBM Spectrum Protect Client may be vulnerable to a denial of service attack due to a timing issue between...

Security Bulletin: SMB signing not required in IBM Spectrum Protect Plus (CVE-2016-2115)

Summary IBM Spectrum Protect Plus is vulnerable to man-in-the-middle attacks as it does not make SMB signing mandatory. Vulnerability Details CVEID: CVE-2016-2115 DESCRIPTION: Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC...

Security Bulletin: Incorrect permissions on restored files and directories on Windows using IBM Spectrum Protect Plus (CVE-2019-4652)

Summary File restore on Windows may not restore NTFS security permissions ACLs. Vulnerability Details CVEID: CVE-2019-4652 DESCRIPTION: Incorrect permissions on restored files and directories on Windows using IBM Spectrum Protect Plus. CVSS Base score: 5.1 CVSS Temporal Score: See:...

Security Bulletin: Incorrect permissions on CIT files in IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-2025)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client creates directories/files in the CIT directory that have insecure permissions. Vulnerability Details CVEID: CVE-2018-2025 DESCRIPTION: IBM Spectrum Protect Client creates directories/files in the CIT sub...

CVE-2019-4406

IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP communications. IBM X-Force ID: 162477...

CVE-2019-4406

IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP communications. IBM X-Force ID: 162477...