CVE-2015-4950: Infoleak

Published Aug 23, 2015

Updated

The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server 2.1, 2.2, 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.1; and Tivoli Storage Manager FastBack for Microsoft Exchange 6.1 before 6.1.5.4 does not ensure that the correct mailbox is selected, which allows remote authenticated users to obtain sensitive information via a duplicate alias name.

Affected Software

15 affected components

IBM Tivoli Storage Fastback For Microsoft Exchange=6.1

IBM Tivoli Storage Flashcopy Manager For Microsoft Exchange Server=2.1

IBM Tivoli Storage Flashcopy Manager For Microsoft Exchange Server=2.2

IBM Tivoli Storage Flashcopy Manager For Microsoft Exchange Server=3.1

IBM Tivoli Storage Flashcopy Manager For Microsoft Exchange Server=3.2

IBM Tivoli Storage Flashcopy Manager For Microsoft Exchange Server=4.1

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.1

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.1.1

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.1.2

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.1.3

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.3

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.3.1

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.4

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=6.4.1

IBM Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server=7.1

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21963629

Event History

Aug 23, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4950?

CVE-2015-4950 is classified as a moderate severity vulnerability.

How do I fix CVE-2015-4950?

To fix CVE-2015-4950, please upgrade to the patched versions of IBM Tivoli Storage Manager or Tivoli Storage FlashCopy Manager as specified in the security advisory.

What products are affected by CVE-2015-4950?

CVE-2015-4950 affects several versions of IBM Tivoli Storage Manager for Mail and Tivoli Storage FlashCopy Manager for Microsoft Exchange Server.

What type of vulnerability is CVE-2015-4950?

CVE-2015-4950 is a vulnerability in the mailbox-restore feature of the affected IBM software.

When was CVE-2015-4950 disclosed?

CVE-2015-4950 was disclosed in 2015, highlighting the need for immediate patching to mitigate risks.