Security Bulletin: Unauthenticated User Could Gain Remote Access to TS3100/TS3200 (CVE-2016-9005)

Summary

IBM TS3100/TS3200 Tape Library could allow an unauthenticated user, with access to the company network, to change a user’s password and gain remote access to the system.

Vulnerability Details

CVEID:CVE-2016-9005__ __
DESCRIPTION:
IBM TS3100-TS3200 Tape Library could allow an unauthenticated user, with access to the company network, to change a user’s password and gain remote access to the system.
CVSS Base Score: 8.8
CVSS Temporal Score: See http://exchange.xforce.ibmcloud.com/vulnerabilities/119393 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Versions D.60 and lower

Remediation/Fixes

Upgrade to version E.20 or later.
After applying the fix, all passwords should either be confirmed or changed to ensure that they were not changed (and therefore accessible) by a third-party.

Workarounds and Mitigations

None