Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against IBM Tivoli Storage Manager Client CAD Service Buffer Overflow

Subscribe

Check Point Reference: CPAI-2009-307
Date Published:
Severity:
Source: Secunia Advisory: SA32534
Industry Reference(s): CVE-2009-3853
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
IBM Tivoli Storage Manager Client 5.3.0.0 to 5.3.6.6
IBM Tivoli Storage Manager Client 5.4.0.0 to 5.4.2.7
IBM Tivoli Storage Manager Client 5.5.0.0 to 5.5.2.1
IBM Tivoli Storage Manager Client 6.1.0.0 to 6.1.0.1
IBM Tivoli Storage Manager Express Client 5.3.3.0 to 5.3.6.6
Vulnerability Description
A buffer overflow vulnerability exists in IBM Tivoli Storage Manager Client software, a backup designed to protect data from failures and other errors by storing backups and archiving data. The vulnerability is due to a boundary error in the Client Acceptor Daemon (CAD) service while processing a specially crafted packet. Remote unauthenticated attackers can exploit this vulnerability to inject and execute arbitrary code on the target system. Successful exploitation of this vulnerability would allow for arbitrary code execution.
Update/Patch Available
The vendor, IBM, has released an advisory addressing this vulnerability:
http://www-01.ibm.com/support/docview.wss?uid=swg21405562
Vulnerability Details
The vulnerability is due to a boundary error in the Client Acceptor Daemon (CAD) service while processing a specially crafted packet sent to the CAD service. Remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted packet with an overly long Computer Name to the CAD service on an affected installation of the TSM Client.

Protection Overview

IPS-1 will detect and block certain malformed packets sent the IBM Tivoli Storage Manager Client dsmcad.exe process.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?

1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence > Enterprise Software, and select the IBM Tivoli Storage Manager protection group.
3. Click IBM Tivoli Storage Manager Express Backup Buffer Overflow (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?

Upon attack, the following entries will be logged:

Alert Name: IBM Tivoli Storage Manager
Description: IBM Tivoli Storage Manager Express Backup Buffer Overflow