CVE-2015-4951: Input Validation

Published Jan 20, 2016

Updated

Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.

Affected Software

6 affected components

IBM Tivoli Storage Manager=5.5

IBM Tivoli Storage Manager=6.1

IBM Tivoli Storage Manager=6.2

IBM Tivoli Storage Manager=6.3

IBM Tivoli Storage Manager=6.4

IBM Tivoli Storage Manager=7.1

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21973484

Event History

Jan 20, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4951?

CVE-2015-4951 has a high severity level due to its potential to cause a denial of service through a crafted Web client URL.

How do I fix CVE-2015-4951?

To fix CVE-2015-4951, upgrade IBM Spectrum Protect to versions 6.3.2.5 or higher, 6.4.3.1 or higher, or 7.1.3 or higher.

What versions of IBM Spectrum Protect are affected by CVE-2015-4951?

CVE-2015-4951 affects IBM Spectrum Protect versions 5.5, 6.1, 6.2, 6.3 prior to 6.3.2.5, 6.4 prior to 6.4.3.1, and 7.1 prior to 7.1.3.

What type of vulnerability is CVE-2015-4951?

CVE-2015-4951 is a remote denial of service vulnerability that can crash the Client Acceptor Daemon.

Who is impacted by CVE-2015-4951?

Administrators and users of affected versions of IBM Spectrum Protect may experience service disruptions due to CVE-2015-4951.