CVE-2007-4880
IBM Tivoli Storage Manager Express CAD Service Buffer Overflow Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.2.5.2, 5.3 before 5.3.5.3, and 5.4 before 5.4.1.2 allows remote attackers to execute arbitrary code via crafted HTTP headers, aka IC52905.
Desbordamiento de búfer en el Demonio Aceptador de Clientes (Client Acceptor Daemon o CAD), dsmcad.exe, en determinados clientes IBM Tivoli Storage Manager (TSM) 5.1 anterior a 5.1.8.1, 5.2 anterior a 5.2.5.2, 5.3 anterior a 5.3.5.3, y 5.4 anterior a 5.4.1.2 permite a atacantes remotos ejecutar código de su elección mediante cabeceras HTTP manipuladas, también conocida como IC52905.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager Express. Authentication is not required to exploit this vulnerability.
The specific flaw exists in the dsmcad.exe process bound by default on TCP port 1581. During HTTP header parsing, a host parameter of sufficient length will trigger an overflow through a call to vswprintf(). The call overflows into imported function pointers which are later called. Exploitation of this issue can result in arbitrary code execution.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2007-09-13 CVE Reserved
- 2007-09-24 CVE Published
- 2007-10-27 First Exploit
- 2024-08-01 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/38161 | Vdb Entry | |
| http://securityreason.com/securityalert/3184 | Third Party Advisory | |
| http://www.securityfocus.com/archive/1/480492 | Mailing List | |
| http://www.securitytracker.com/id?1018725 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2007/3228 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-07-054.html | X_refsource_misc |
|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/36700 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/16764 | 2010-05-09 | |
| https://www.exploit-db.com/exploits/4573 | 2007-10-27 |
| URL | Date | SRC |
|---|---|---|
| http://www-1.ibm.com/support/docview.wss?uid=swg21268775 | 2017-07-29 | |
| http://www-1.ibm.com/support/search.wss?rs=0&q=IC52905&apar=only | 2017-07-29 | |
| http://www.securityfocus.com/bid/25743 | 2017-07-29 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/26883 | 2017-07-29 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.1 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.1" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.1.8.0 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.1.8.0" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.2 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.2" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.2.5.1 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.2.5.1" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.3 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.3" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.3.5.2 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.3.5.2" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.4 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.4" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Tivoli Storage Manager Client Search vendor "Ibm" for product "Tivoli Storage Manager Client" | 5.4.1.1 Search vendor "Ibm" for product "Tivoli Storage Manager Client" and version "5.4.1.1" | - |
Affected
| ||||||