Secunia

A vulnerability has been reported in IBM Tivoli Provisioning Manager for OS Deployment, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the logging functionality of the web server component. This can be exploited to cause a buffer overflow by sending a specially crafted request with an overly large HTTP request method to an affected system (port TCP/443).

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in version 5.1.0.3.

Solution
Apply Interim Fix 3, version 5.1.0.3 (5.1.0-TIV-TPMOSD-IF0003). Please see the vendor's advisory for details.

Provided and/or discovered by
An anonymous person, reported via iDefense Labs.

Changelog
Further details available in Customer Area

Original Advisory
IBM:
http://www-1.ibm.com/support/docview.wss?uid=swg24018010

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=647

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area