IBM Tivoli Storage Manager FastBack Server Opcode 1329 Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of opcode 1329. By sending a crafted packet on TCP port 11460, an attacker can force the process to read an arbitrary file and return the contents. An attacker can use this to disclose information under the context of SYSTEM.