CVE-2016-5934 (GCVE-0-2016-5934)
Vulnerability from cvelistv5 – Published: 2017-02-08 22:00 – Updated: 2024-08-06 01:15
VLAI?
Summary
IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim's path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim.
Severity ?
No CVSS data available.
CWE
- Gain Access
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| IBM Corporation | Tivoli Storage Manager FastBack |
Affected:
5.5
Affected: 6.1 Affected: 5.5.0 Affected: 5.5.1 Affected: 5.5.2 Affected: 5.5.2.0 Affected: 5.5.3.0 Affected: 5.5.4.0 Affected: 5.5.5.0 Affected: 5.5.6.0 Affected: 6.1.0.0 Affected: 6.1.0.1 Affected: 3.5.604 Affected: 3.5.705 Affected: 3.5.801 Affected: 3.5.802 Affected: 3.5.804 Affected: 5.5.7 Affected: 6.1.1.0 Affected: unspecified Affected: 6.1.1 Affected: 6.1.2 Affected: 6.1.3 Affected: 6.1.4 Affected: 6.1.5 Affected: 6.1.6 Affected: 6.1.7 Affected: 6.1.8 Affected: 6.1.9 Affected: 6.1.10 Affected: 6.1.11 Affected: 6.1.12 Affected: 5.5.6 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:15:10.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92614",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92614"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg21988908"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Tivoli Storage Manager FastBack",
"vendor": "IBM Corporation",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "5.5.0"
},
{
"status": "affected",
"version": "5.5.1"
},
{
"status": "affected",
"version": "5.5.2"
},
{
"status": "affected",
"version": "5.5.2.0"
},
{
"status": "affected",
"version": "5.5.3.0"
},
{
"status": "affected",
"version": "5.5.4.0"
},
{
"status": "affected",
"version": "5.5.5.0"
},
{
"status": "affected",
"version": "5.5.6.0"
},
{
"status": "affected",
"version": "6.1.0.0"
},
{
"status": "affected",
"version": "6.1.0.1"
},
{
"status": "affected",
"version": "3.5.604"
},
{
"status": "affected",
"version": "3.5.705"
},
{
"status": "affected",
"version": "3.5.801"
},
{
"status": "affected",
"version": "3.5.802"
},
{
"status": "affected",
"version": "3.5.804"
},
{
"status": "affected",
"version": "5.5.7"
},
{
"status": "affected",
"version": "6.1.1.0"
},
{
"status": "affected",
"version": "unspecified"
},
{
"status": "affected",
"version": "6.1.1"
},
{
"status": "affected",
"version": "6.1.2"
},
{
"status": "affected",
"version": "6.1.3"
},
{
"status": "affected",
"version": "6.1.4"
},
{
"status": "affected",
"version": "6.1.5"
},
{
"status": "affected",
"version": "6.1.6"
},
{
"status": "affected",
"version": "6.1.7"
},
{
"status": "affected",
"version": "6.1.8"
},
{
"status": "affected",
"version": "6.1.9"
},
{
"status": "affected",
"version": "6.1.10"
},
{
"status": "affected",
"version": "6.1.11"
},
{
"status": "affected",
"version": "6.1.12"
},
{
"status": "affected",
"version": "5.5.6"
}
]
}
],
"datePublic": "2016-08-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim\u0027s path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-02-09T10:57:02",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "92614",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92614"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=swg21988908"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"ID": "CVE-2016-5934",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tivoli Storage Manager FastBack",
"version": {
"version_data": [
{
"version_value": "5.5"
},
{
"version_value": "6.1"
},
{
"version_value": "5.5.0"
},
{
"version_value": "5.5.1"
},
{
"version_value": "5.5.2"
},
{
"version_value": "5.5.2.0"
},
{
"version_value": "5.5.3.0"
},
{
"version_value": "5.5.4.0"
},
{
"version_value": "5.5.5.0"
},
{
"version_value": "5.5.6.0"
},
{
"version_value": "6.1.0.0"
},
{
"version_value": "6.1.0.1"
},
{
"version_value": "3.5.604"
},
{
"version_value": "3.5.705"
},
{
"version_value": "3.5.801"
},
{
"version_value": "3.5.802"
},
{
"version_value": "3.5.804"
},
{
"version_value": "5.5.7"
},
{
"version_value": "6.1.1.0"
},
{
"version_value": ""
},
{
"version_value": "6.1.1"
},
{
"version_value": "6.1.2"
},
{
"version_value": "6.1.3"
},
{
"version_value": "6.1.4"
},
{
"version_value": "6.1.5"
},
{
"version_value": "6.1.6"
},
{
"version_value": "6.1.7"
},
{
"version_value": "6.1.8"
},
{
"version_value": "6.1.9"
},
{
"version_value": "6.1.10"
},
{
"version_value": "6.1.11"
},
{
"version_value": "6.1.12"
},
{
"version_value": "5.5.6"
}
]
}
}
]
},
"vendor_name": "IBM Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim\u0027s path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92614",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92614"
},
{
"name": "http://www.ibm.com/support/docview.wss?uid=swg21988908",
"refsource": "CONFIRM",
"url": "http://www.ibm.com/support/docview.wss?uid=swg21988908"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2016-5934",
"datePublished": "2017-02-08T22:00:00",
"dateReserved": "2016-06-29T00:00:00",
"dateUpdated": "2024-08-06T01:15:10.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:tivoli_storage_manager_fastback:*:*:*:*:demo:*:*:*\", \"matchCriteriaId\": \"B30ED7B4-7A0B-4461-A0F4-478D8721512F\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim\u0027s path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim.\"}, {\"lang\": \"es\", \"value\": \"El instalador IBM Tivoli Storage Manager FastBack podr\\u00eda permitir a un atacante remoto ejecutar c\\u00f3digo arbitrario en el sistema. Al colocar una DLL especialmente manipulada en el camino de la v\\u00edctima, un atacante podr\\u00eda explotar esta vulnerabilidad cuando el instalador se ejecuta para ejecutar c\\u00f3digo arbitrario en el sistema con privilegios de la v\\u00edctima.\"}]",
"id": "CVE-2016-5934",
"lastModified": "2024-11-21T02:55:14.167",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.3, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 6.9, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.4, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2017-02-08T22:59:00.637",
"references": "[{\"url\": \"http://www.ibm.com/support/docview.wss?uid=swg21988908\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/92614\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.ibm.com/support/docview.wss?uid=swg21988908\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/92614\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
"sourceIdentifier": "psirt@us.ibm.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2016-5934\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2017-02-08T22:59:00.637\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim\u0027s path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim.\"},{\"lang\":\"es\",\"value\":\"El instalador IBM Tivoli Storage Manager FastBack podr\u00eda permitir a un atacante remoto ejecutar c\u00f3digo arbitrario en el sistema. Al colocar una DLL especialmente manipulada en el camino de la v\u00edctima, un atacante podr\u00eda explotar esta vulnerabilidad cuando el instalador se ejecuta para ejecutar c\u00f3digo arbitrario en el sistema con privilegios de la v\u00edctima.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":6.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:tivoli_storage_manager_fastback:*:*:*:*:demo:*:*:*\",\"matchCriteriaId\":\"B30ED7B4-7A0B-4461-A0F4-478D8721512F\"}]}]}],\"references\":[{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg21988908\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92614\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.ibm.com/support/docview.wss?uid=swg21988908\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92614\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…