|
|
| |
| A vulnerability allows attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager Express for Microsoft SQL. Authentication is not required to exploit this vulnerability. |
| |
Credit:
The information has been provided by The Zero Day Initiative (ZDI).
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-08-071
|
| |
Vulnerable Systems:
* IBM Tivoli Storage Manager Express
The specific flaw resides in the Data Protection for SQL CAD service, dsmcat.exe, which listens by default on a TCP port above 1024. The process trusts a user-supplied size value, receiving the specified amount of data into a static heap buffer. By sending a specially crafted packet, an attacker can overflow that buffer leading to arbitrary code execution in the context of the SYSTEM user.
Vendor Response:
IBM has issued an update to correct this vulnerability. More details can be found at:
http://www-01.ibm.com/support/docview.wss?uid=swg21322623
Disclosure Timeline:
2008-05-12 - Vulnerability reported to vendor
2008-10-30 - Coordinated public release of advisory
|
|
|
