CVE-2016-2894: Infoleak
First published: Sun Jul 03 2016(Updated: )
IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved data from arbitrary accounts in opportunistic circumstances by leveraging previous use of a symlink during archive and retrieve actions.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Tivoli Storage Manager | =5.5 | |
| IBM Tivoli Storage Manager | =5.5.0 | |
| IBM Tivoli Storage Manager | =5.5.2 | |
| IBM Tivoli Storage Manager | =5.5.3 | |
| IBM Tivoli Storage Manager | =5.5.4 | |
| IBM Tivoli Storage Manager | =5.5.4.1 | |
| IBM Tivoli Storage Manager | =5.5.4.2 | |
| IBM Tivoli Storage Manager | =5.5.4.3 | |
| IBM Tivoli Storage Manager | =6.1 | |
| IBM Tivoli Storage Manager | =6.1.0 | |
| IBM Tivoli Storage Manager | =6.1.1 | |
| IBM Tivoli Storage Manager | =6.1.2 | |
| IBM Tivoli Storage Manager | =6.1.3 | |
| IBM Tivoli Storage Manager | =6.1.4 | |
| IBM Tivoli Storage Manager | =6.1.5 | |
| IBM Tivoli Storage Manager | =6.1.5.4 | |
| IBM Tivoli Storage Manager | =6.1.5.5 | |
| IBM Tivoli Storage Manager | =6.1.5.6 | |
| IBM Tivoli Storage Manager | =6.2 | |
| IBM Tivoli Storage Manager | =6.2.0 | |
| IBM Tivoli Storage Manager | =6.2.1 | |
| IBM Tivoli Storage Manager | =6.2.2 | |
| IBM Tivoli Storage Manager | =6.2.3 | |
| IBM Tivoli Storage Manager | =6.2.4 | |
| IBM Tivoli Storage Manager | =6.2.4.7 | |
| IBM Tivoli Storage Manager | =6.3 | |
| IBM Tivoli Storage Manager | =6.3.0 | |
| IBM Tivoli Storage Manager | =6.3.0.5 | |
| IBM Tivoli Storage Manager | =6.3.0.15 | |
| IBM Tivoli Storage Manager | =6.3.0.17 | |
| IBM Tivoli Storage Manager | =6.3.1 | |
| IBM Tivoli Storage Manager | =6.3.1.2 | |
| IBM Tivoli Storage Manager | =6.3.2.2 | |
| IBM Tivoli Storage Manager | =6.4 | |
| IBM Tivoli Storage Manager | =6.4.0 | |
| IBM Tivoli Storage Manager | =6.4.0.1 | |
| IBM Tivoli Storage Manager | =6.4.0.4 | |
| IBM Tivoli Storage Manager | =6.4.0.5 | |
| IBM Tivoli Storage Manager | =6.4.0.7 | |
| IBM Tivoli Storage Manager | =6.4.1.3 | |
| IBM Tivoli Storage Manager | =6.4.1.7 | |
| IBM Tivoli Storage Manager | =6.4.2.1 | |
| IBM Tivoli Storage Manager | =6.4.2.100 | |
| IBM Tivoli Storage Manager | =6.4.2.200 | |
| IBM Tivoli Storage Manager | =6.4.3 | |
| IBM Tivoli Storage Manager | =6.4.3.1 | |
| IBM Tivoli Storage Manager | =7.1 | |
| IBM Tivoli Storage Manager | =7.1..5.100 | |
| IBM Tivoli Storage Manager | =7.1.0.1 | |
| IBM Tivoli Storage Manager | =7.1.0.2 | |
| IBM Tivoli Storage Manager | =7.1.0.3 | |
| IBM Tivoli Storage Manager | =7.1.1 | |
| IBM Tivoli Storage Manager | =7.1.1.1 | |
| IBM Tivoli Storage Manager | =7.1.1.100 | |
| IBM Tivoli Storage Manager | =7.1.1.200 | |
| IBM Tivoli Storage Manager | =7.1.1.300 | |
| IBM Tivoli Storage Manager | =7.1.2 | |
| IBM Tivoli Storage Manager | =7.1.3 | |
| IBM Tivoli Storage Manager | =7.1.3.000 | |
| IBM Tivoli Storage Manager | =7.1.3.1 | |
| IBM Tivoli Storage Manager | =7.1.3.2 | |
| IBM Tivoli Storage Manager | =7.1.3.100 | |
| IBM Tivoli Storage Manager | =7.1.4 | |
| IBM Tivoli Storage Manager | =7.1.4.1 | |
| IBM Tivoli Storage Manager | =7.1.5 | |
| IBM Tivoli Storage Manager | =7.1.5.200 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-2894?
CVE-2016-2894 is considered to have a medium severity level.
How do I fix CVE-2016-2894?
To address CVE-2016-2894, upgrade IBM Spectrum Protect to the latest version as specified by IBM.
Who is affected by CVE-2016-2894?
CVE-2016-2894 affects local users of IBM Spectrum Protect versions 5.5 to 7.1.
What type of attack is facilitated by CVE-2016-2894?
CVE-2016-2894 enables local users to access sensitive retrieved data from arbitrary accounts.
When was CVE-2016-2894 reported?
CVE-2016-2894 was reported in March 2016.
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm tivoli storage manager
- version/ibm tivoli storage manager/5.5
- version/ibm tivoli storage manager/5.5.0
- version/ibm tivoli storage manager/5.5.2
- version/ibm tivoli storage manager/5.5.3
- version/ibm tivoli storage manager/5.5.4
- version/ibm tivoli storage manager/5.5.4.1
- version/ibm tivoli storage manager/5.5.4.2
- version/ibm tivoli storage manager/5.5.4.3
- version/ibm tivoli storage manager/6.1
- version/ibm tivoli storage manager/6.1.0
- version/ibm tivoli storage manager/6.1.1
- version/ibm tivoli storage manager/6.1.2
- version/ibm tivoli storage manager/6.1.3
- version/ibm tivoli storage manager/6.1.4
- version/ibm tivoli storage manager/6.1.5
- version/ibm tivoli storage manager/6.1.5.4
- version/ibm tivoli storage manager/6.1.5.5
- version/ibm tivoli storage manager/6.1.5.6
- version/ibm tivoli storage manager/6.2
- version/ibm tivoli storage manager/6.2.0
- version/ibm tivoli storage manager/6.2.1
- version/ibm tivoli storage manager/6.2.2
- version/ibm tivoli storage manager/6.2.3
- version/ibm tivoli storage manager/6.2.4
- version/ibm tivoli storage manager/6.2.4.7
- version/ibm tivoli storage manager/6.3
- version/ibm tivoli storage manager/6.3.0
- version/ibm tivoli storage manager/6.3.0.5
- version/ibm tivoli storage manager/6.3.0.15
- version/ibm tivoli storage manager/6.3.0.17
- version/ibm tivoli storage manager/6.3.1
- version/ibm tivoli storage manager/6.3.1.2
- version/ibm tivoli storage manager/6.3.2.2
- version/ibm tivoli storage manager/6.4
- version/ibm tivoli storage manager/6.4.0
- version/ibm tivoli storage manager/6.4.0.1
- version/ibm tivoli storage manager/6.4.0.4
- version/ibm tivoli storage manager/6.4.0.5
- version/ibm tivoli storage manager/6.4.0.7
- version/ibm tivoli storage manager/6.4.1.3
- version/ibm tivoli storage manager/6.4.1.7
- version/ibm tivoli storage manager/6.4.2.1
- version/ibm tivoli storage manager/6.4.2.100
- version/ibm tivoli storage manager/6.4.2.200
- version/ibm tivoli storage manager/6.4.3
- version/ibm tivoli storage manager/6.4.3.1
- version/ibm tivoli storage manager/7.1
- version/ibm tivoli storage manager/7.1..5.100
- version/ibm tivoli storage manager/7.1.0.1
- version/ibm tivoli storage manager/7.1.0.2
- version/ibm tivoli storage manager/7.1.0.3
- version/ibm tivoli storage manager/7.1.1
- version/ibm tivoli storage manager/7.1.1.1
- version/ibm tivoli storage manager/7.1.1.100
- version/ibm tivoli storage manager/7.1.1.200
- version/ibm tivoli storage manager/7.1.1.300
- version/ibm tivoli storage manager/7.1.2
- version/ibm tivoli storage manager/7.1.3
- version/ibm tivoli storage manager/7.1.3.000
- version/ibm tivoli storage manager/7.1.3.1
- version/ibm tivoli storage manager/7.1.3.2
- version/ibm tivoli storage manager/7.1.3.100
- version/ibm tivoli storage manager/7.1.4
- version/ibm tivoli storage manager/7.1.4.1
- version/ibm tivoli storage manager/7.1.5
- version/ibm tivoli storage manager/7.1.5.200