News
Vigil@nce - IBM Tivoli Storage Manager: password disclosure
October 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use a vulnerability in IBM Tivoli Storage Manager
or FlashCopy, in order to obtain sensitive information.
– Impacted products: Tivoli Storage Manager.
– Severity: 2/4.
– Creation date: 14/08/2015.
DESCRIPTION OF THE VULNERABILITY
The following applications use passwords:
- Tivoli Storage Manager for Databases: Data Protection for
Microsoft SQL Server
- Tivoli Storage Manager for Mail: Data Protection for Microsoft
Exchange Server
- Tivoli Storage FlashCopy Manager on Windows
However, when an error occurs, this password is displayed in a
window, and written in the log files.
An attacker can therefore use a vulnerability in IBM Tivoli
Storage Manager or FlashCopy, in order to obtain sensitive
information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/IBM-Tivoli-Storage-Manager-password-disclosure-17673
