CVE-2016-8940: Infoleak
First published: Tue Mar 07 2017(Updated: )
IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Tivoli Storage Manager | =6.1 | |
| IBM Tivoli Storage Manager | =6.1.0 | |
| IBM Tivoli Storage Manager | =6.1.1 | |
| IBM Tivoli Storage Manager | =6.1.2 | |
| IBM Tivoli Storage Manager | =6.1.3 | |
| IBM Tivoli Storage Manager | =6.1.4 | |
| IBM Tivoli Storage Manager | =6.1.5 | |
| IBM Tivoli Storage Manager | =6.1.5.4 | |
| IBM Tivoli Storage Manager | =6.1.5.5 | |
| IBM Tivoli Storage Manager | =6.1.5.6 | |
| IBM Tivoli Storage Manager | =6.2.0 | |
| IBM Tivoli Storage Manager | =6.2.1 | |
| IBM Tivoli Storage Manager | =6.2.2 | |
| IBM Tivoli Storage Manager | =6.2.3 | |
| IBM Tivoli Storage Manager | =6.2.4 | |
| IBM Tivoli Storage Manager | =6.3 | |
| IBM Tivoli Storage Manager | =6.3.0.5 | |
| IBM Tivoli Storage Manager | =6.3.0.15 | |
| IBM Tivoli Storage Manager | =6.3.0.17 | |
| IBM Tivoli Storage Manager | =6.3.1 | |
| IBM Tivoli Storage Manager | =6.3.1.2 | |
| IBM Tivoli Storage Manager | =6.3.2.2 | |
| IBM Tivoli Storage Manager | =6.3.3 | |
| IBM Tivoli Storage Manager | =6.3.4 | |
| IBM Tivoli Storage Manager | =6.3.5 | |
| IBM Tivoli Storage Manager | =6.3.5.1 | |
| IBM Tivoli Storage Manager | =6.3.6 | |
| IBM Tivoli Storage Manager | =7.1 | |
| IBM Tivoli Storage Manager | =7.1..5.100 | |
| IBM Tivoli Storage Manager | =7.1.0.1 | |
| IBM Tivoli Storage Manager | =7.1.0.2 | |
| IBM Tivoli Storage Manager | =7.1.0.3 | |
| IBM Tivoli Storage Manager | =7.1.1 | |
| IBM Tivoli Storage Manager | =7.1.1.1 | |
| IBM Tivoli Storage Manager | =7.1.1.2 | |
| IBM Tivoli Storage Manager | =7.1.1.100 | |
| IBM Tivoli Storage Manager | =7.1.1.200 | |
| IBM Tivoli Storage Manager | =7.1.1.300 | |
| IBM Tivoli Storage Manager | =7.1.3 | |
| IBM Tivoli Storage Manager | =7.1.3.000 | |
| IBM Tivoli Storage Manager | =7.1.3.1 | |
| IBM Tivoli Storage Manager | =7.1.3.2 | |
| IBM Tivoli Storage Manager | =7.1.3.100 | |
| IBM Tivoli Storage Manager | =7.1.4 | |
| IBM Tivoli Storage Manager | =7.1.4.1 | |
| IBM Tivoli Storage Manager | =7.1.4.2 | |
| IBM Tivoli Storage Manager | =7.1.5 | |
| IBM Tivoli Storage Manager | =7.1.5.200 | |
| IBM Tivoli Storage Manager | =7.1.6 | |
| IBM Tivoli Storage Manager | =7.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-8940?
CVE-2016-8940 is classified as a medium severity vulnerability due to insufficient authority checking in SQL queries in IBM Tivoli Storage Manager.
How do I fix CVE-2016-8940?
To remediate CVE-2016-8940, users should upgrade to a patched version of IBM Tivoli Storage Manager that addresses this vulnerability.
What versions of IBM Tivoli Storage Manager are affected by CVE-2016-8940?
CVE-2016-8940 affects IBM Tivoli Storage Manager versions 6.1 through 7.1.
What are the consequences of exploiting CVE-2016-8940?
Exploitation of CVE-2016-8940 may allow an attacker to access unauthorized database tables and sensitive information.
Is there a workaround for CVE-2016-8940?
Currently, there are no known workarounds for CVE-2016-8940; the recommended solution is to apply the appropriate software update.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/references
- agent/remedy
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm tivoli storage manager
- version/ibm tivoli storage manager/6.1
- version/ibm tivoli storage manager/6.1.0
- version/ibm tivoli storage manager/6.1.1
- version/ibm tivoli storage manager/6.1.2
- version/ibm tivoli storage manager/6.1.3
- version/ibm tivoli storage manager/6.1.4
- version/ibm tivoli storage manager/6.1.5
- version/ibm tivoli storage manager/6.1.5.4
- version/ibm tivoli storage manager/6.1.5.5
- version/ibm tivoli storage manager/6.1.5.6
- version/ibm tivoli storage manager/6.2.0
- version/ibm tivoli storage manager/6.2.1
- version/ibm tivoli storage manager/6.2.2
- version/ibm tivoli storage manager/6.2.3
- version/ibm tivoli storage manager/6.2.4
- version/ibm tivoli storage manager/6.3
- version/ibm tivoli storage manager/6.3.0.5
- version/ibm tivoli storage manager/6.3.0.15
- version/ibm tivoli storage manager/6.3.0.17
- version/ibm tivoli storage manager/6.3.1
- version/ibm tivoli storage manager/6.3.1.2
- version/ibm tivoli storage manager/6.3.2.2
- version/ibm tivoli storage manager/6.3.3
- version/ibm tivoli storage manager/6.3.4
- version/ibm tivoli storage manager/6.3.5
- version/ibm tivoli storage manager/6.3.5.1
- version/ibm tivoli storage manager/6.3.6
- version/ibm tivoli storage manager/7.1
- version/ibm tivoli storage manager/7.1..5.100
- version/ibm tivoli storage manager/7.1.0.1
- version/ibm tivoli storage manager/7.1.0.2
- version/ibm tivoli storage manager/7.1.0.3
- version/ibm tivoli storage manager/7.1.1
- version/ibm tivoli storage manager/7.1.1.1
- version/ibm tivoli storage manager/7.1.1.2
- version/ibm tivoli storage manager/7.1.1.100
- version/ibm tivoli storage manager/7.1.1.200
- version/ibm tivoli storage manager/7.1.1.300
- version/ibm tivoli storage manager/7.1.3
- version/ibm tivoli storage manager/7.1.3.000
- version/ibm tivoli storage manager/7.1.3.1
- version/ibm tivoli storage manager/7.1.3.2
- version/ibm tivoli storage manager/7.1.3.100
- version/ibm tivoli storage manager/7.1.4
- version/ibm tivoli storage manager/7.1.4.1
- version/ibm tivoli storage manager/7.1.4.2
- version/ibm tivoli storage manager/7.1.5
- version/ibm tivoli storage manager/7.1.5.200
- version/ibm tivoli storage manager/7.1.6
- version/ibm tivoli storage manager/7.1.7