Security Bulletin: Multiple DB2 vulnerabilities affect IBM Spectrum Protect (formerly Tivoli Storage Manger) Server (CVE-2017-1434, CVE-2017-1438, CVE-2017-1439, CVE-2017-1451, CVE-2017-1452)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM DB2 vulnerabilities that could allow exposure of sensitive information to the local user or elevation of privileges. Vulnerability Details CVEID: CVE-2017-1434 DESCRIPTION: IBM DB2 for Linux, UNIX and...

Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect IBM Spectrum Protect (Tivoli Storage Manager) Windows and Macintosh Client

Summary There are multiple vulnerabilities in the IBM® Runtime Environment Java™ packaged with the IBM Spectrum Protect formerly Tivoli Storage Manager Windows and Macintosh Client. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details CVEID:...

Security Bulletin:Multiple security vulnerabilities identified in IBM WebSphere Application Server affect IBM Tivoli Storage Manager FastBack Reporting

Summary IBM Tivoli Storage Manager FastBack Reporting requires the dependent product IBM WebSphere Application Server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Operations Center and Client Management Services (CVE-2017-10115, CVE-2017-10116)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ that is used by IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center and IBM Spectrum Protect formerly Tivoli Storage Manager Client Management Service. These issues were disclosed as part of the IBM Ja...

Security Bulletin: Potential password exposure in IBM Spectrum Protect (formerly Tivoli Storage Manger) Server (CVE-2017-1339)

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server may use a weak algorithm for encrypting passwords. Vulnerability Details CVEID: CVE-2017-1339 DESCRIPTION: IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager Server uses weak encryption for the password. A...

Security Bulletin: Multiple security vulnerabilities identified in IBM WebSphere Application Server affect IBM Tivoli Storage Manager FastBack Reporting

Summary IBM Tivoli Storage Manager FastBack Reporting requires the dependent product IBM WebSphere Application Server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security...

Security Bulletin: vCenter password disclosure via application tracing in IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Client and IBM Spectrum Protect for Virtual Environments formerly Tivoli Storage Manager for Virtual Environments: Data Protection from VMware may display the obfuscated VMware vCenter userID and password during VM related operation...

Security Bulletin: GSKit Sweet32 Birthday attacks on 64-bit block ciphers in TLS affects the Tivoli Storage Manager (IBM Spectrum Protect) Server (CVE-2016-2183)

Summary GSKit is vulnerable to Sweet32 Birthday attacks on 64-bit block ciphers in TLS which affects the Tivoli Storage Manager IBM Spectrum Protect Server. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: An error in the DES/3DES cipher, used as a part of the SSL/TLS protocol, could allow...

Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect Tivoli Storage Manager (IBM Spectrum Protect) for Virtual Environments: Data Protection for VMware and FlashCopy Manager (IBM Spectrum Protect Snapshot) for VMware

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by Tivoli Storage Manager for Virtual Environments IBM Spectrum Protect for Virtual Environments: Data Protection for VMware and FlashCopy Manager IBM Spectrum Protect Snapshot for VMware. These issues were disclose...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server affecting IBM Tivoli Storage Manager FastBack Reporting

Summary IBM Tivoli Storage Manager FastBack Reporting requires the dependent product IBM WebSphere Application Server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security...

Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect Tivoli Storage Manager (IBM Spectrum Protect) for Virtual Environments: Data Protection for VMware (CVE-2016-5597)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ used by Tivoli Storage Mangaer for Virtual Environments IBM Spectrum Protect for Virtual Enviornments: Data Protection for VMware. These issues were disclosed as part of the IBM Java SDK updates in October 2016...

Security Bulletin: Tivoli Storage Manager (IBM Spectrum Protect) SQL interface vulnerable to unauthorized access (CVE-2016-8940)

Summary Tivoli Storage Manager IBM Spectrum Protect SQL interface is vulnerable to unauthorized access to user credentials and product sensitive information. Vulnerability Details CVEID: CVE-2016-8940 DESCRIPTION: IBM Tivoli Storage Manager IBM Spectrum Protect does not perform sufficient authori...

Security Bulletin: A security vulnerability has been identified in Tivoli Integrated Portal shipped with IBM Tivoli Storage Manager FastBack for Workstations (CVE-2017-1121)

Summary Inside the Tivoli Integrated Portal there is a potential cross-site scripting vulnerability in the Admin Console of WebSphere Application Server in the underlying eWAS Vulnerability Details Please consult the Security Bulletin: Potential Cross-site scripting vulnerability in WebSphere...

Security Bulletin: A security vulnerability has been identified in Tivoli Integrated Portal shipped with IBM Tivoli Storage Manager FastBack for Workstations (CVE-2016-8919)

Summary Inside the Tivoli Integrated Portal there is a potential denial of service with WebSphere Application Server with SOAP connectors in the underlying eWAS. Vulnerability Details Please consult the Security Bulletin: Denial of Service with WebSphere Application Server CVE-2016-8919 for...

Security Bulletin: DB2 local escalation of privilege vulnerability affects Tivoli Storage Manager (IBM Spectrum Protect) Server (CVE-2016-5995)

Summary Tivoli Storage Manager IBM Spectrum Protect Server is affected by an IBM DB2 software vulnerability that can result in a local user gaining root level access to which the user is not entitled. Vulnerability Details CVEID: CVE-2016-5995 DESCRIPTION: DB2 for Linux, Unix and Windows is...

Security Bulletin: Buffer Overflow from improperly formatted SELECT command in IBM Tivoli Storage Manager (IBM Spectrum Protect) Server (CVE-2016-8998)

Summary An improperly formatted SELECT command to an IBM Tivoli Storage Manager IBM Spectrum Protect Server can cause a buffer overflow that could allow an attacker to execute arbitrary code on the server. Vulnerability Details CVEID: CVE-2016-8998 DESCRIPTION: IBM Tivoli Storage Manager Server...

Security Bulletin: Password Disclosure via instrumentation log in Tivoli Storage Manager (IBM Spectrum Protect) Client (CVE-2016-8916)

Summary When using the "set password" Tivoli Storage Manger IBM Spectrum Protect client command, the full text of the command and included password is written to the instrumentation log file if instrumentation tracing is enabled. For 7.1.6.0 and higher, instrumentation tracing is enabled by defau...

Security Bulletin: vCenter password disclosure via application tracing in IBM Tivoli Storage Manager Client and IBM Tivoli Storage Manager for Virtual Environments:Data Protection for VMware (CVE-2016-6110)

Summary The IBM Tivoli Storage Manager Client may display the obfuscated VMware vCenter userID and password during VM backup with the INCLUDE.VMTSMVSS option when application tracing is enabled with VMTSMVSS flag. This problem only manifests when the Tivoli Storage Manager Client is used as the I...

Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware on Windows (CVE-2016-3485)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware IBM Spectrum Protect™ for Virtual Environments. These issues were disclosed as part of the IBM Java SDK...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server affect Tivoli Storage Manager (IBM Spectrum Protect) for Virtual Environments: Data Protection for VMware (CVE-2016-5986, CVE-2016-3092)

Summary Security vulnerabilities exist in IBM WebSphere Application Server that affect Tivoli Storage Manager for Virtual Environments IBM Spectrum Protect for Virtual Environments: Data Protection for VMware. Vulnerability Details CVEID: CVE-2016-5986 DESCRIPTION: IBM WebSphere Application Serve...