CVE-2006-5855
Multiple buffer overflows in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in (1) the language field at logon that…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 26.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple buffer overflows in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in (1) the language field at logon that begins with a 0x18 byte, (2) two unspecified parameters to the SmExecuteWdsfSession function, and (3) the contact field in an open registration message.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 26.68% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- ibm/tivoli storage manager
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/23177Vendor Advisory
- http://securityreason.com/securityalert/1979
- http://securitytracker.com/id?1017333
- http://www-1.ibm.com/support/docview.wss?uid=swg1IC50347Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21250261Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/350625US Government Resource
- http://www.kb.cert.org/vuls/id/478753US Government Resource
- http://www.kb.cert.org/vuls/id/887249US Government Resource
- http://www.securityfocus.com/archive/1/453544/100/0/threaded
- http://www.securityfocus.com/bid/21440Patch, Vendor Advisory
- http://www.tippingpoint.com/security/advisories/TSRT-06-14.htmlVendor Advisory
- http://www.vupen.com/english/advisories/2006/4856
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30699
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30701
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30702
- http://secunia.com/advisories/23177Vendor Advisory
- http://securityreason.com/securityalert/1979
- http://securitytracker.com/id?1017333
- http://www-1.ibm.com/support/docview.wss?uid=swg1IC50347Patch, Vendor Advisory
- http://www-1.ibm.com/support/docview.wss?uid=swg21250261Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/350625US Government Resource
- http://www.kb.cert.org/vuls/id/478753US Government Resource
- http://www.kb.cert.org/vuls/id/887249US Government Resource
- http://www.securityfocus.com/archive/1/453544/100/0/threaded
- http://www.securityfocus.com/bid/21440Patch, Vendor Advisory
- http://www.tippingpoint.com/security/advisories/TSRT-06-14.htmlVendor Advisory
- http://www.vupen.com/english/advisories/2006/4856
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30699
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30701
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30702
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.