Details of VAR-201408-0329

ID

VAR-201408-0329

CVE

CVE-2014-0876

TITLE

Windows and OS X Run on IBM Tivoli Storage Manager Backup / Archive client preference editor and Java GUI Configuration Wizard Buffer Overflow Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-003834

DESCRIPTION

Buffer overflow in the Java GUI Configuration Wizard and Preferences Editor in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.x and 6.x before 6.2.5.2, 6.3.x before 6.3.2, and 6.4.x before 6.4.2 on Windows and OS X allows local users to cause a denial of service (application crash or hang) via unspecified vectors. IBM Tivoli Storage Manager is prone to local denial-of-service vulnerability. Successful exploits will allow local attackers to cause a denial-of-service conditions. The solution supports data protection, space management and archiving, business recovery and disaster recovery, etc. A local attacker could exploit this vulnerability to cause a denial of service (application crash or hang). The following versions are affected: IBM TSM 5.x and 6.x prior to 6.2.5.2, 6.3.x prior to 6.3.2, and 6.4.x prior to 6.4.2

Trust: 2.07

sources: NVD: CVE-2014-0876 // JVNDB: JVNDB-2014-003834 // BID: 69261 // VULHUB: VHN-68369 // VULMON: CVE-2014-0876

AFFECTED PRODUCTS

vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	6.1.0	Trust: 1.6
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.0	Trust: 1.6
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.5.0	Trust: 1.6
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	6.2.0	Trust: 1.6
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	6.4.0	Trust: 1.6
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	6.3.0	Trust: 1.6
vendor:	ibm	model:	spectrum protect	scope:	eq	version:	6.2.5.2	Trust: 0.8
vendor:	ibm	model:	spectrum protect	scope:	lt	version:	6.4.x	Trust: 0.8
vendor:	ibm	model:	spectrum protect	scope:	eq	version:	6.4.2	Trust: 0.8
vendor:	ibm	model:	spectrum protect	scope:	lt	version:	6.3.x	Trust: 0.8
vendor:	ibm	model:	spectrum protect	scope:	eq	version:	6.3.2	Trust: 0.8
vendor:	ibm	model:	spectrum protect	scope:	lt	version:	6.x	Trust: 0.8
vendor:	ibm	model:	spectrum protect	scope:	eq	version:	5.x	Trust: 0.8
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.1.54	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	5.5.41	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	5.5.4	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	5.5	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.4.1	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.4.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.3	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.2.4	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.2.3	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.2.2	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4.2.7	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager	scope:	eq	version:	5.4	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.4	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.2.2	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.1.4	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	5.5.3	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.4.0.1	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.3.1.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.3.0.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.2.5.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.2.4.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.2.1.1	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.2.1.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.2.0.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.1.5.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.1.3.4	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.1.3.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	6.1.0.0	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	5.5.2.7	Trust: 0.3
vendor:	ibm	model:	tivoli storage manager client	scope:	eq	version:	5.5.2.12	Trust: 0.3

sources: BID: 69261 // JVNDB: JVNDB-2014-003834 // CNNVD: CNNVD-201408-267 // NVD: CVE-2014-0876

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-0876
value:	LOW
Trust: 1.0
NVD:	CVE-2014-0876
value:	LOW
Trust: 0.8
CNNVD:	CNNVD-201408-267
value:	LOW
Trust: 0.6
VULHUB:	VHN-68369
value:	LOW
Trust: 0.1
VULMON:	CVE-2014-0876
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2014-0876
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-68369
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-68369 // VULMON: CVE-2014-0876 // JVNDB: JVNDB-2014-003834 // CNNVD: CNNVD-201408-267 // NVD: CVE-2014-0876

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-68369 // JVNDB: JVNDB-2014-003834 // NVD: CVE-2014-0876

THREAT TYPE

local

Trust: 0.9

sources: BID: 69261 // CNNVD: CNNVD-201408-267

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201408-267

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-003834

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-68369

PATCH

title:	1673318	url:	http://www-01.ibm.com/support/docview.wss?uid=swg21673318	Trust: 0.8
title:	6.2.5.2-TIV-TSMBAC_ZH_CN-Mac	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51666	Trust: 0.6
title:	6.2.5.2-TIV-TSMBAC_CHS-WinX32	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51665	Trust: 0.6
title:	6.4.2.0-TIV-TSMBAC_ZH_CN-Mac	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51670	Trust: 0.6
title:	6.4.2.0-TIV-TSMBAC_CHS-WinX32	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51669	Trust: 0.6
title:	6.3.2.0-TIV-TSMBAC_CHS-WinX32	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51667	Trust: 0.6
title:	6.3.2.0-TIV-TSMBAC_ZH_CN-Mac	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=51668	Trust: 0.6

sources: JVNDB: JVNDB-2014-003834 // CNNVD: CNNVD-201408-267

EXTERNAL IDS

db:	NVD	id:	CVE-2014-0876	Trust: 2.9
db:	JVNDB	id:	JVNDB-2014-003834	Trust: 0.8
db:	CNNVD	id:	CNNVD-201408-267	Trust: 0.7
db:	XF	id:	91063	Trust: 0.6
db:	BID	id:	69261	Trust: 0.4
db:	VULHUB	id:	VHN-68369	Trust: 0.1
db:	VULMON	id:	CVE-2014-0876	Trust: 0.1

sources: VULHUB: VHN-68369 // VULMON: CVE-2014-0876 // BID: 69261 // JVNDB: JVNDB-2014-003834 // CNNVD: CNNVD-201408-267 // NVD: CVE-2014-0876

REFERENCES

url:	http://www-01.ibm.com/support/docview.wss?uid=swg21673318	Trust: 2.1
url:	http://www-01.ibm.com/support/docview.wss?uid=swg1ic95875	Trust: 1.8
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/91063	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0876	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0876	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/91063	Trust: 0.6
url:	http://www.ibm.com/	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=swg24036287	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=swg24036718	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=swg24037543	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-68369 // VULMON: CVE-2014-0876 // BID: 69261 // JVNDB: JVNDB-2014-003834 // CNNVD: CNNVD-201408-267 // NVD: CVE-2014-0876

CREDITS

IBM

Trust: 0.3

sources: BID: 69261

SOURCES

db:	VULHUB	id:	VHN-68369
db:	VULMON	id:	CVE-2014-0876
db:	BID	id:	69261
db:	JVNDB	id:	JVNDB-2014-003834
db:	CNNVD	id:	CNNVD-201408-267
db:	NVD	id:	CVE-2014-0876

LAST UPDATE DATE

2024-08-14T15:35:04.714000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-68369	date:	2017-08-29T00:00:00
db:	VULMON	id:	CVE-2014-0876	date:	2017-08-29T00:00:00
db:	BID	id:	69261	date:	2014-08-12T00:00:00
db:	JVNDB	id:	JVNDB-2014-003834	date:	2014-08-19T00:00:00
db:	CNNVD	id:	CNNVD-201408-267	date:	2014-08-20T00:00:00
db:	NVD	id:	CVE-2014-0876	date:	2017-08-29T01:34:18.467

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-68369	date:	2014-08-17T00:00:00
db:	VULMON	id:	CVE-2014-0876	date:	2014-08-17T00:00:00
db:	BID	id:	69261	date:	2014-08-12T00:00:00
db:	JVNDB	id:	JVNDB-2014-003834	date:	2014-08-19T00:00:00
db:	CNNVD	id:	CNNVD-201408-267	date:	2014-08-20T00:00:00
db:	NVD	id:	CVE-2014-0876	date:	2014-08-17T23:55:06.243