Arbitrary Code Execution in IBM Tivoli Storage Manager FastBack Installer
CVE-2016-5934

7.3HIGH

Key Information:

Vendor

IBM
Status
Tivoli Storage Manager Fastback
Vendor
CVE Published:
8 February 2017

What is CVE-2016-5934?

The IBM Tivoli Storage Manager FastBack installer is vulnerable to arbitrary code execution due to insufficient validation mechanisms. An attacker can exploit this vulnerability by placing a specially-crafted DLL in the target system's path. When the installer is executed, it may perform actions that allow the attacker to run arbitrary code with the same privileges as the user executing the installer, potentially compromising the system's integrity and confidentiality.

Affected Version(s)

Tivoli Storage Manager FastBack 5.5

Tivoli Storage Manager FastBack 6.1

Tivoli Storage Manager FastBack 5.5.0

References

http://www.securityfocus.com/bid/92614
vdb-entryx_refsource_BID
http://www.ibm.com/support/docview.wss?uid=swg21988908
x_refsource_CONFIRM

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.