‘IBM Tivoli Storage Manager Express for Microsoft SQL Heap Overflow Vulnerability’
Summary
‘
Credit:
‘The information has been provided by The Zero Day Initiative (ZDI).
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-08-071‘
Details
‘Vulnerable Systems:
* IBM Tivoli Storage Manager Express
The specific flaw resides in the Data Protection for SQL CAD service, dsmcat.exe, which listens by default on a TCP port above 1024. The process trusts a user-supplied size value, receiving the specified amount of data into a static heap buffer. By sending a specially crafted packet, an attacker can overflow that buffer leading to arbitrary code execution in the context of the SYSTEM user.
Vendor Response:
IBM has issued an update to correct this vulnerability. More details can be found at:
http://www-01.ibm.com/support/docview.wss?uid=swg21322623
Disclosure Timeline:
2008-05-12 – Vulnerability reported to vendor
2008-10-30 – Coordinated public release of advisory’