Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @

EGI CSIRT:Alerts/tsm-2010-12-16

From EGIWiki
Revision as of 13:27, 16 December 2010 by Ocalladw (talk | contribs) (Created page with ''''DRAFT''' <pre> ** WHITE information - Unlimited distribution allowed ** ** see for distribution restrictions **…')
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search


** WHITE information - Unlimited distribution allowed                       ** 
** see for distribution restrictions **


Title:       CRITICAL Root vulnerabilities in TSM clients [EGI-ADV-20101216] TLP:WHITE
Date:        2010-12-16



<Describe the reason for the issuing of this advisory - paragraph 3-5 sentences > 

< A vulnerability has been found in <xxx> software which is part of the <yyy> distribution.> 

<this could include - e.g. updated as patch available> 

<include cve- number if one has been issued> 

<include EGI RT number for SVG/UMD issues>


<describe the problem, something about why it occurs, and the effect on sites>

<take care not to release anything useful to an attacker, unless it is already public, 
especially if you are sending it in WHITE>

<this should not be long>

Risk Category

This issue has been assessed as CRITICAL by the EGI CSIRT for sites who are using this software, 
but it is high risk for the EGI infrastructure as a whole.

Affected Software

IBM Tivoli Storage Manager (TSM). RedHat packages are named TIVsm-*.

For each release, the vendor has provided the version numbers for vulnerable and fixed patch levels.

Release    Vulnerable versions        Fixed version
TSM 6.2 through    6.2.2
TSM 6.1 through    6.1.4
TSM 5.5 through   5.5.3
TSM 5.4 through


The only known mitigation is to install the patched software available from IBM.

The remote access vulnerability

Component Installation information

Fixes are available from IBM, linked from the Alert at


<as appropriate e.g.>

<Immediately apply the mitigation described above to all user-accessible systems.>

<Immediately apply vendor kernel updates when they become available.>

<List vendors who have already announced patches>

<Apply new version in EGI UMD>

<Sites are recommended to update relevant components.>

<(For critical) All running resources MUST be either patched or otherwise have a
work-around in place by yyyy-mm-dd  T21:00+01:00. 

<7 calendar days - but if the date falls on a Friday, weekend, or common public holiday, 
make it the first working day after people are expected back>


This vulnerability was reported by IBM and Kryptos Logic.


IBM Alert:


2010-12-14 IBM alert published
2010-12-15 EGI CSIRT / RAT /SVG notified
2010-12-16 EGI advisory published

On behalf of the EGI CSIRT and SVG