A security issue has been reported in IBM Tivoli Continuous Data Protection for Files, which can be exploited by malicious, local users to compromise other systems.

The problem is caused due to insecure default file permissions being set on the server's global download directory. This can be exploited to gain escalated privileges by placing malicious files in the directory, which will be distributed to and executed on the client machines.

The security issue is reported in version 3.1. Other versions may also be affected.

Solution
The vendor recommends setting proper permissions on the directory to ensure that only trusted users have write-access.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
APAR IC54264:
http://www-1.ibm.com/support/docview.wss?uid=swg1IC54264

Technote 1272084:
http://www-1.ibm.com/support/docview.wss?uid=swg21272084

Deep Links
Links available to Secunia VIM customers