CVE-2016-8916: Infoleak
Published May 5, 2017
·Updated
IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472.
Affected Software
36 affected components
IBM Tivoli Storage Manager<=6.3
IBM Tivoli Storage Manager=6.4.0.0
IBM Tivoli Storage Manager=6.4.1
IBM Tivoli Storage Manager=6.4.1.0
IBM Tivoli Storage Manager=6.4.2
IBM Tivoli Storage Manager=6.4.2.100
IBM Tivoli Storage Manager=6.4.2.200
IBM Tivoli Storage Manager=6.4.2.500
IBM Tivoli Storage Manager=6.4.2.600
IBM Tivoli Storage Manager=6.4.3
IBM Tivoli Storage Manager=6.4.3.1
IBM Tivoli Storage Manager=7.1
IBM Tivoli Storage Manager=7.1..5.100
IBM Tivoli Storage Manager=7.1.0.1
IBM Tivoli Storage Manager=7.1.0.2
IBM Tivoli Storage Manager=7.1.0.3
IBM Tivoli Storage Manager=7.1.1
IBM Tivoli Storage Manager=7.1.1.1
IBM Tivoli Storage Manager=7.1.1.2
IBM Tivoli Storage Manager=7.1.1.100
IBM Tivoli Storage Manager=7.1.1.200
IBM Tivoli Storage Manager=7.1.1.300
IBM Tivoli Storage Manager=7.1.3
IBM Tivoli Storage Manager=7.1.3.000
IBM Tivoli Storage Manager=7.1.3.1
IBM Tivoli Storage Manager=7.1.3.2
IBM Tivoli Storage Manager=7.1.3.100
IBM Tivoli Storage Manager=7.1.4
IBM Tivoli Storage Manager=7.1.4.1
IBM Tivoli Storage Manager=7.1.4.2
IBM Tivoli Storage Manager=7.1.5
IBM Tivoli Storage Manager=7.1.5.200
IBM Tivoli Storage Manager=7.1.6
IBM Tivoli Storage Manager=7.1.6.2
IBM Tivoli Storage Manager=7.1.6.3
IBM Tivoli Storage Manager=7.1.6.4
Remediation
Patch Available
Event History
May 5, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-8916?
CVE-2016-8916 is considered to have a medium severity due to the potential exposure of sensitive password information.
2
How do I fix CVE-2016-8916?
To fix CVE-2016-8916, users should upgrade to a patched version of IBM Tivoli Storage Manager that does not log sensitive information.
3
Which versions are affected by CVE-2016-8916?
CVE-2016-8916 affects IBM Tivoli Storage Manager versions 5.5, 6.1 to 6.4, and 7.1.
4
What type of information is exposed in CVE-2016-8916?
CVE-2016-8916 exposes password information that is stored in log files, making it accessible to local users.
5
Is CVE-2016-8916 a local or remote vulnerability?
CVE-2016-8916 is a local vulnerability, as it requires access to the affected system to read the log files.