CVE-2015-7408

Vulnerability

The IBM Spectrum Protect (formerly Tivoli Storage Manager) server fails to properly restrict the use of the ASNODENAME option. This option allows a client session to run as a proxy for another client to which the user has been granted proxy authority. The server does not adequately check the authorization of sessions using this option, causing them to run as fully authorized sessions. Affected versions include 5.5, 6.x before 6.3.5.1, and 7.x before 7.1.4 [1][2].

Exploitation

An attacker with network access to the server and proxy authority to another client can use the ASNODENAME option to impersonate that client. The attacker then initiates a session that the server treats as authorized, bypassing the intended access controls [1].

Impact

Successful exploitation allows the attacker to read or write backup data belonging to the impersonated client, leading to unauthorized disclosure or modification of backup data. The CVSS v3 base score is 3.7 (Low) with a vector of AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N [1].

Mitigation

IBM has fixed this vulnerability in Tivoli Storage Manager server versions 7.1.4 and 6.3.5.1. Users on earlier versions should upgrade to these or later releases. For other affected levels, contact IBM support to obtain the appropriate fix. The APAR number is IT13609 [1][2].