Vulnerabilities > CVE-2008-4801 - Buffer Errors vulnerability in IBM products

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
ibm
CWE-119
critical
NVD
Published: 2008-10-31
Updated: 2018-11-02

Summary

Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Acceptor Daemon (CAD) and the scheduler in the Backup-Archive client 5.1.0.0 through 5.1.8.1, 5.2.0.0 through 5.2.5.2, 5.3.0.0 through 5.3.6.1, 5.4.0.0 through 5.4.2.2, and 5.5.0.0 through 5.5.0.91 in IBM Tivoli Storage Manager (TSM); and the Backup-Archive client in TSM Express; allows remote attackers to execute arbitrary code by sending a large amount of crafted data to a TCP port.

Vulnerable Configurations

Part Description Count
Application
Ibm
16

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 31988 CVE(CAN) ID: CVE-2008-4801 Tivoli Storage Manager是一种遵循ANSI SAN标准的可扩展解决方案，用于发现、监控和管理企业SAN架构组件，并可分配和自动操纵企业的附加磁盘存储资源。 IBM Tivoli存储管理器Backup-Archive客户端的Data Protection for SQL CAD服务（dsmcat.exe）存在堆溢出漏洞。该进程默认监听于大于1024的TCP端口上，错误的信任了用户提供的大小值，将指定数量的数据拷贝到了静态的堆缓冲区。如果远程攻击者向该服务发送了特制报文的话，就可以触发堆溢出，导致以SYSTEM用户权限执行任意指令。 IBM Tivoli Storage Manager 5.5 IBM Tivoli Storage Manager 5.4 IBM Tivoli Storage Manager 5.3 IBM Tivoli Storage Manager 5.2 IBM Tivoli Storage Manager 5.1 临时解决方法： * 在客户端机器上将SCHEDMODE选项设置为默认的POLLING。 * 停止使用CAD并终止dsmcad。 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://www.tivoli.com/support/storage_mgr/ target=_blank>http://www.tivoli.com/support/storage_mgr/</a>
idSSV:4380
last seen2017-11-19
modified2008-10-31
published2008-10-31
reporterRoot
titleIBM Tivoli存储管理器客户端远程堆溢出漏洞

References