CVE-2010-4604

Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.2.10, and 6.1.x before 6.1.3.1 on Unix and Linux allows local users to gain privileges by specifying a long LANG environment variable, and then sending a request over a pipe.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg21454745	Broken Link Vendor Advisory
http://securitytracker.com/id?1024901	Broken Link Third Party Advisory VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg1IC65491	Broken Link
http://www.vupen.com/english/advisories/2010/3251	Broken Link Vendor Advisory
http://secunia.com/advisories/42639	Broken Link Vendor Advisory
http://www.exploit-db.com/exploits/15745	Exploit Third Party Advisory VDB Entry
http://www.kryptoslogic.com/advisories/2010/kryptoslogic-ibm-tivoli-dsmtca.txt	Broken Link
http://www.kryptoslogic.com/advisories/2010/kryptoslogic-ibm-tivoli-dsmtca-exploit.c	Broken Link Exploit
http://www.securityfocus.com/archive/1/515263/100/0/threaded	Broken Link Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:tivoli_storage_manager::::::::
	cpe:2.3:a:ibm:tivoli_storage_manager::::::::
	cpe:2.3:a:ibm:tivoli_storage_manager::::::::
	cpe:2.3:a:ibm:tivoli_storage_manager::::::::

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Information

Published : 2010-12-29 10:00

Updated : 2022-12-13 13:27

NVD link : CVE-2010-4604

Mitre link : CVE-2010-4604

JSON object : View

CWE

CWE-787

Out-of-bounds Write

Advertisement

Products Affected

linux

linux_kernel

ibm

tivoli_storage_manager

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg21454745", "name": "http://www.ibm.com/support/docview.wss?uid=swg21454745", "tags": ["Broken Link", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://securitytracker.com/id?1024901", "name": "1024901", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC65491", "name": "IC65491", "tags": ["Broken Link"], "refsource": "AIXAPAR"}, {"url": "http://www.vupen.com/english/advisories/2010/3251", "name": "ADV-2010-3251", "tags": ["Broken Link", "Vendor Advisory"], "refsource": "VUPEN"}, {"url": "http://secunia.com/advisories/42639", "name": "42639", "tags": ["Broken Link", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.exploit-db.com/exploits/15745", "name": "15745", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "refsource": "EXPLOIT-DB"}, {"url": "http://www.kryptoslogic.com/advisories/2010/kryptoslogic-ibm-tivoli-dsmtca.txt", "name": "http://www.kryptoslogic.com/advisories/2010/kryptoslogic-ibm-tivoli-dsmtca.txt", "tags": ["Broken Link"], "refsource": "MISC"}, {"url": "http://www.kryptoslogic.com/advisories/2010/kryptoslogic-ibm-tivoli-dsmtca-exploit.c", "name": "http://www.kryptoslogic.com/advisories/2010/kryptoslogic-ibm-tivoli-dsmtca-exploit.c", "tags": ["Broken Link", "Exploit"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/archive/1/515263/100/0/threaded", "name": "20101215 Kryptos Logic Advisory: IBM Tivoli Storage Manager (TSM) Local Root", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.2.10, and 6.1.x before 6.1.3.1 on Unix and Linux allows local users to gain privileges by specifying a long LANG environment variable, and then sending a request over a pipe."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-787"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2010-4604", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2010-12-29T18:00Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:tivoli_storage_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.1.3", "versionStartIncluding": "6.1.0"}, {"cpe23Uri": "cpe:2.3:a:ibm:tivoli_storage_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "5.5.2.7", "versionStartIncluding": "5.5.0"}, {"cpe23Uri": "cpe:2.3:a:ibm:tivoli_storage_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "5.4.3.3", "versionStartIncluding": "5.4.0"}, {"cpe23Uri": "cpe:2.3:a:ibm:tivoli_storage_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "5.3.6.7", "versionStartIncluding": "5.3.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-12-13T21:27Z"}