CVE-2010-3754: OS Command Injection
The FXCLIOraBRExecCommand function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 uses values of packet fields to determine the content and length of data copied to memory, which allows remote attackers to execute arbitrary code via a crafted packet. NOTE: this might overlap CVE-2010-3059.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3754?
CVE-2010-3754 has a medium severity rating due to its potential exploitation by remote attackers.
How do I fix CVE-2010-3754?
To fix CVE-2010-3754, update IBM Tivoli Storage Manager FastBack to the latest version provided by IBM.
What versions are affected by CVE-2010-3754?
CVE-2010-3754 affects IBM Tivoli Storage Manager FastBack versions 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1.
What attack vectors are associated with CVE-2010-3754?
CVE-2010-3754 allows remote attackers to execute arbitrary commands through crafted packet fields sent to the FastBackServer.exe.
Is there a permanent solution for CVE-2010-3754?
Yes, upgrading to a patched version of IBM Tivoli Storage Manager FastBack is the permanent solution for CVE-2010-3754.