TippingPoint Security Research Team has reported some vulnerabilities in Tivoli Storage Manager, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) A boundary error exists during the processing of the language field in the initial sign-on request when the first byte of the string is set to "0x18". This can be exploited to cause a buffer overflow via a specially crafted message with an overly long language field.

2) Boundary errors in the "SmExecuteWdsfSession()" function when handling certain message fields can be exploited to cause a buffer overflow via a specially crafted message.

3) A boundary error within the open registration message can be exploited to cause a buffer overflow.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in the following versions:
* Tivoli Storage Manager <5.2.9
* Tivoli Storage Manager <5.3.4

Solution
Apply vendor patch.

Provided and/or discovered by
TippingPoint Security Research Team

Changelog
Further details available in Customer Area

Original Advisory
IBM:
http://www-1.ibm.com/support/docview.wss?uid=swg21250261

TippingPoint:
http://www.tippingpoint.com/security/advisories/TSRT-06-14.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area