CVE-2010-3754: OS Command Injection
First published: Tue Oct 05 2010(Updated: )
The FXCLI_OraBR_Exec_Command function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 uses values of packet fields to determine the content and length of data copied to memory, which allows remote attackers to execute arbitrary code via a crafted packet. NOTE: this might overlap CVE-2010-3059.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Tivoli Storage Manager FastBack | =6.1.0.0 | |
| IBM Tivoli Storage Manager FastBack | =6.1.0.1 | |
| IBM Tivoli Storage Manager FastBack | =5.5.3.0 | |
| IBM Tivoli Storage Manager FastBack | =5.5.0 | |
| IBM Tivoli Storage Manager FastBack | =5.5.4.0 | |
| IBM Tivoli Storage Manager FastBack | =5.5.5.0 | |
| IBM Tivoli Storage Manager FastBack | =5.5.2 | |
| IBM Tivoli Storage Manager FastBack | =5.5.6.0 | |
| IBM Tivoli Storage Manager FastBack | =5.5.1 | |
| IBM Tivoli Storage Manager FastBack | =5.5.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2010-3754?
CVE-2010-3754 has a medium severity rating due to its potential exploitation by remote attackers.
How do I fix CVE-2010-3754?
To fix CVE-2010-3754, update IBM Tivoli Storage Manager FastBack to the latest version provided by IBM.
What versions are affected by CVE-2010-3754?
CVE-2010-3754 affects IBM Tivoli Storage Manager FastBack versions 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1.
What attack vectors are associated with CVE-2010-3754?
CVE-2010-3754 allows remote attackers to execute arbitrary commands through crafted packet fields sent to the FastBackServer.exe.
Is there a permanent solution for CVE-2010-3754?
Yes, upgrading to a patched version of IBM Tivoli Storage Manager FastBack is the permanent solution for CVE-2010-3754.
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/ibm
- canonical/ibm tivoli storage manager fastback
- version/ibm tivoli storage manager fastback/5.5.0
- version/ibm tivoli storage manager fastback/5.5.1
- version/ibm tivoli storage manager fastback/5.5.2
- version/ibm tivoli storage manager fastback/5.5.2.0
- version/ibm tivoli storage manager fastback/5.5.3.0
- version/ibm tivoli storage manager fastback/5.5.4.0
- version/ibm tivoli storage manager fastback/5.5.5.0
- version/ibm tivoli storage manager fastback/5.5.6.0
- version/ibm tivoli storage manager fastback/6.1.0.0
- version/ibm tivoli storage manager fastback/6.1.0.1