CVE-2016-8998 - Vulnerability Details

Vendors	Products
Ibm	Tivoli Storage Manager

Link	Providers
http://www.ibm.com/support/docview.wss?uid=swg21998747
http://www.securityfocus.com/bid/96443

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Tivoli Storage Manager", "vendor": "IBM Corporation", "versions": [{"status": "affected", "version": "7.1"}]}], "datePublic": "2017-02-22T00:00:00", "descriptions": [{"lang": "en", "value": "IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747."}], "problemTypes": [{"descriptions": [{"description": "Gain Access", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-03-01T10:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"name": "96443", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/96443"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21998747"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2016-8998", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Tivoli Storage Manager", "version": {"version_data": [{"version_value": "7.1"}]}}]}, "vendor_name": "IBM Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Gain Access"}]}]}, "references": {"reference_data": [{"name": "96443", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96443"}, {"name": "http://www.ibm.com/support/docview.wss?uid=swg21998747", "refsource": "CONFIRM", "url": "http://www.ibm.com/support/docview.wss?uid=swg21998747"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T02:35:02.321Z"}, "title": "CVE Program Container", "references": [{"name": "96443", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/96443"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21998747"}]}]}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-8998", "datePublished": "2017-02-24T18:00:00", "dateReserved": "2016-10-25T00:00:00", "dateUpdated": "2024-08-06T02:35:02.321Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Tivoli Storage Manager (string)

vendor : IBM Corporation (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.1 (string)

}

]

}

]

datePublic : 2017-02-22T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Gain Access (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-03-01T10:57:01 (string)

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

}

references : [ »

0 : { »

name : 96443 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/96443 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21998747 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@us.ibm.com (string)

ID : CVE-2016-8998 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Tivoli Storage Manager (string)

version : { »

version_data : [ »

0 : { »

version_value : 7.1 (string)

}

]

}

]

}

vendor_name : IBM Corporation (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Gain Access (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : 96443 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/96443 (string)

}

1 : { »

name : http://www.ibm.com/support/docview.wss?uid=swg21998747 (string)

refsource : CONFIRM (string)

url : http://www.ibm.com/support/docview.wss?uid=swg21998747 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-06T02:35:02.321Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 96443 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/96443 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21998747 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

assignerShortName : ibm (string)

cveId : CVE-2016-8998 (string)

datePublished : 2017-02-24T18:00:00 (string)

dateReserved : 2016-10-25T00:00:00 (string)

dateUpdated : 2024-08-06T02:35:02.321Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "C59C16BD-1CB8-47BB-8352-B1609798BB0C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "BB3B365E-0505-4A43-90A6-811D39BB6262", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "B880E34D-A9B4-4A64-B734-71ADC0588761", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.100:*:*:*:*:*:*:*", "matchCriteriaId": "E6A07C8F-4DD0-4767-8A8F-A1721EBDE583", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.200:*:*:*:*:*:*:*", "matchCriteriaId": "5D972077-A132-430D-97E6-8F0F8B0F79B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.300:*:*:*:*:*:*:*", "matchCriteriaId": "4DC78448-7AD8-438B-8AFC-79B31FB706D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "C3B578C6-A29A-41B6-A9B6-F7A08D9BE34B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.000:*:*:*:*:*:*:*", "matchCriteriaId": "6FC3FEDA-B353-4C31-A349-1A12F4FAF465", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "E8CA94D1-06FB-4C94-83FB-2BC52676BBDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "302756E5-F3E8-4F5E-90EA-A81A88DB55AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.100:*:*:*:*:*:*:*", "matchCriteriaId": "D92EDDEE-1135-4EE7-972E-19471352E0A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "7C980FE7-8B2D-4ED4-A5BF-78615AD0F596", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "FD269C39-1070-44C3-B7FC-968C12A344E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "F7AACC13-50CF-4229-B204-E30523A38721", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "1AC65208-F124-4D28-B5D8-3A3C774C82A6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.5.200:*:*:*:*:*:*:*", "matchCriteriaId": "E782420B-2A62-4537-88EB-1169C73AC21B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:tivoli_storage_manager:7.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "834EBEBA-70E1-4089-A064-6BBFAD50D1CB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747."}, {"lang": "es", "value": "IBM Tivoli Storage Manager Server 7.1 podr\u00eda permitir a un usuario autenticado con privilegios de administrador TSM provocar un desbordamiento de b\u00fafer utilizando una consulta SQL especialmente manipulada y ejecutar c\u00f3digo arbitrario en el servidor. Referencia de IBM: 1998747."}], "id": "CVE-2016-8998", "lastModified": "2024-11-21T03:00:24.893", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-02-24T18:59:00.147", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21998747"}, {"source": "psirt@us.ibm.com", "url": "http://www.securityfocus.com/bid/96443"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21998747"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/96443"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : C59C16BD-1CB8-47BB-8352-B1609798BB0C (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : BB3B365E-0505-4A43-90A6-811D39BB6262 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : B880E34D-A9B4-4A64-B734-71ADC0588761 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.100:*:*:*:*:*:*:* (string)

matchCriteriaId : E6A07C8F-4DD0-4767-8A8F-A1721EBDE583 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.200:*:*:*:*:*:*:* (string)

matchCriteriaId : 5D972077-A132-430D-97E6-8F0F8B0F79B1 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.1.300:*:*:*:*:*:*:* (string)

matchCriteriaId : 4DC78448-7AD8-438B-8AFC-79B31FB706D1 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3:*:*:*:*:*:*:* (string)

matchCriteriaId : C3B578C6-A29A-41B6-A9B6-F7A08D9BE34B (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.000:*:*:*:*:*:*:* (string)

matchCriteriaId : 6FC3FEDA-B353-4C31-A349-1A12F4FAF465 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.1:*:*:*:*:*:*:* (string)

matchCriteriaId : E8CA94D1-06FB-4C94-83FB-2BC52676BBDC (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 302756E5-F3E8-4F5E-90EA-A81A88DB55AD (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.3.100:*:*:*:*:*:*:* (string)

matchCriteriaId : D92EDDEE-1135-4EE7-972E-19471352E0A8 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 7C980FE7-8B2D-4ED4-A5BF-78615AD0F596 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.4.1:*:*:*:*:*:*:* (string)

matchCriteriaId : FD269C39-1070-44C3-B7FC-968C12A344E8 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.4.2:*:*:*:*:*:*:* (string)

matchCriteriaId : F7AACC13-50CF-4229-B204-E30523A38721 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 1AC65208-F124-4D28-B5D8-3A3C774C82A6 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.5.200:*:*:*:*:*:*:* (string)

matchCriteriaId : E782420B-2A62-4537-88EB-1169C73AC21B (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:ibm:tivoli_storage_manager:7.1.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 834EBEBA-70E1-4089-A064-6BBFAD50D1CB (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747. (string)

}

1 : { »

lang : es (string)

value : IBM Tivoli Storage Manager Server 7.1 podría permitir a un usuario autenticado con privilegios de administrador TSM provocar un desbordamiento de búfer utilizando una consulta SQL especialmente manipulada y ejecutar código arbitrario en el servidor. Referencia de IBM: 1998747. (string)

}

]

id : CVE-2016-8998 (string)

lastModified : 2024-11-21T03:00:24.893 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : PARTIAL (string)

baseScore : 6 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:S/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 6.8 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-02-24T18:59:00.147 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21998747 (string)

}

1 : { »

source : psirt@us.ibm.com (string)

url : http://www.securityfocus.com/bid/96443 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : http://www.ibm.com/support/docview.wss?uid=swg21998747 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://www.securityfocus.com/bid/96443 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-119 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object