Security Bulletin: vCenter password disclosure via application tracing in IBM Tivoli Storage Manager Client and IBM Tivoli Storage Manager for Virtual Environments:Data Protection for VMware (CVE-2016-6110)

Summary The IBM Tivoli Storage Manager Client may display the obfuscated VMware vCenter userID and password during VM backup with the INCLUDE.VMTSMVSS option when application tracing is enabled with VMTSMVSS flag. This problem only manifests when the Tivoli Storage Manager Client is used as the I...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server affect Tivoli Storage Manager (IBM Spectrum Protect) for Virtual Environments: Data Protection for VMware (CVE-2016-5986, CVE-2016-3092)

Summary Security vulnerabilities exist in IBM WebSphere Application Server that affect Tivoli Storage Manager for Virtual Environments IBM Spectrum Protect for Virtual Environments: Data Protection for VMware. Vulnerability Details CVEID: CVE-2016-5986 DESCRIPTION: IBM WebSphere Application Serve...

Security Bulletin: A security vulnerability has been identified in IBM Tivoli Storage Manager that affects IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (CVE-2016-2894)

Summary The IBM Tivoli Storage Manger IBM Spectrum Protect Client is used as a component of IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware IBM Spectrum Protect for Virtual Environments. Information about a security vulnerability affecting the IBM Tivoli Manager...

Security Bulletin: IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware GUI User May Gain Administrator Authority

Summary A vulnerability exists in the IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware GUI IBM Spectrum Protect™ for Virtual Environments where an authenticated user can execute GUI functions that require the Tivoli Storage Manager administrative credentials without...

Security Bulletin: SQL Server Password Disclosure via IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server and IBM Tivoli Storage FlashCopy Manager for Microsoft SQL Server (CVE-2016-3059)

Summary When using IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server or IBM Tivoli Storage FlashCopy Manager for Microsoft SQL Server, the Microsoft SQL Server's user ID and password is presented in plain text via task completion status details available within th...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Virtual Environments: Data Protection for Microsoft Hyper-V (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Virtual Environments: Data Protection for Microsoft Hyper-V IBM Spectrum Protect for Virtual Environments on Windows platforms. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server IBM Spectrum Protect for Mail on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTIO...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Mail: Data Protection for Domino (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Mail: Data Protection for Domino IBM Spectrum Protect for Mail on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Databases: Data Protection for Oracle (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Databases: Data Protection for Oracle IBM Spectrum Protect for Databases on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexer...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server IBM Spectrum Protect for Databases on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Continuous Data Protection for Files (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects the IBM Tivoli Continuous Data Protection for Files Client. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTION: Flexera InstallShield could allow a local attacker to gain elevated...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and IBM Tivoli Storage FlashCopy Manager for VMware (CVE-2015-4872)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware IBM Spectrum Protect™ for Virtual Environments and IBM Tivoli Storage FlashCopy Manager for VMware IBM...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and IBM Tivoli Storage FlashCopy Manager for VMware (CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition that is used by IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware IBM Spectrum Protect™ for Virtual Environments and IBM Tivoli Storage FlashCopy Manager for VMware IBM...

Security Bulletin: A security vulnerability has been identified in the Tivoli Storage Manager Client shipped with IBM Tivoli Storage FlashCopy Manager for Windows (CVE-2015-0287)

Summary The IBM Tivoli Storage Manger client IBM Spectrum Protect is shipped as a component of IBM Tivoli Storage FlashCopy Manager for Windows IBM Spectrum Protect Snapshot. Information about a security vulnerability affecting the IBM Tivoli Manager client has been published in a security...

Security Bulletin: Vulnerabilities in OpenSSL affect the IBM Tivoli Storage Manager Client and IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (CVE-2015-0287)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL, used by the Tivoli Storage Manager Client, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0287 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error...

Security Bulletin: A vulnerability in the GSKit component of IBM Tivoli Continuous Data Protection for Files (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component in the underlying Tivoli Storage Manager API included in IBM Tivoli Continous Data Protection for Files. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive informatio...

Security Bulletin: Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and Tivoli Storage FlashCopy Manager for VMware affected by privilege escalation vulnerability (CVE-2015-7429)

Summary The IBM Data Protection Extension in the VMware GUI component of IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware IBM Spectrum Protect for Virtual Environments and IBM Tivoli Storage FlashCopy Manager for VMware IBM Spectrum Protect Snapshot are subject to a...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects the IBM Tivoli Storage Manager Client and the IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware data mover (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects the IBM Tivoli Storage Manager Client. However, the problem only manifests when the Tivoli Storage Manager Client is used as the IBM Tivoli Storage Manager for Virtual Environments: Data...

Security Bulletin: Additional Password Disclosure via application tracing in FlashCopy Manager on Windows, Data Protection for Exchange, and Data Protection for SQL CVE-2015-7404

Summary The Tivoli Storage Manager TSM password is displayed in plain text via application trace output when the "Change TSM Password" changetsmpassword command is used and application tracing is enabled. Vulnerability Details CVEID: CVE-2015-7404 DESCRIPTION: When using one of the following...

Security Bulletin: Password Disclosure via FlashCopy Manager on Windows, Data Protection for Exchange, and Data Protection for SQL CVE-2015-4949, CVE 2015-6557

Summary The password associated with Tivoli Storage Manager or the Microsoft SQL DB user is displayed in plain text via application pop-up messages for failed operations and in application trace output. Vulnerability Details CVEID: CVE-2015-4949 DESCRIPTION: IBM Tivoli Storage Manager for Databas...