Security Bulletin: A security vulnerability has been identified in the IBM Spectrum Protect Client that affects multiple IBM Spectrum Protect products (CVE-2018-1786)

Summary

The IBM Spectrum Protect (formerly Tivoli Storage Manger) Client/API is used as a component of IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for Windows, IBM Spectrum Protect for Databases, and IBM Spectrum Protect for Mail. Information about a security vulnerability affecting the IBM Spectrum Protect Client/API has been published in a security bulletin.

Vulnerability Details

Consult the security bulletin Denial of Service vulnerability affects IBM Spectrum Protect Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-1786) for vulnerability details and information about the fixes.

Affected Products and Versions

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Spectrum Protect Snapshot for Windows version 8.1 | IBM Spectrum Protect Client/API version 8.1.
IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for Windows version 4.1 | IBM Spectrum Protect (formerly Tivoli Storage Manager) Client/API version 7.1
Tivoli Storage FlashCopy Manager for Windows version 6.4 and below are EOS. IBM recommends upgrading to a supported level. | Tivoli Storage Manager Client/API version 6.4 and below are EOS. IBM recommends upgrading to a supported level.

Note: Within the IBM Spectrum Protect Snapshot on Windows product, the IBM Spectrum Protect Client is also referred to as the FlashCopy Manager VSS Requestor component.

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Spectrum Protect for Databases: Data Protection for Microsoft SQL Server version 8.1 | IBM Spectrum Protect Client/API version 8.1.
IBM Spectrum Protect for Databases (formerly Tivoli Storage Manager for Databases): Data Protection for Microsoft SQL Server version 7.1 | IBM Spectrum Protect (formerly Tivoli Storage Manager) Client/API version 7.1
Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server version 6.4 and below are EOS. IBM recommends upgrading to a supported level. | Tivoli Storage Manager Client/API version 6.4 and below are EOS. IBM recommends upgrading to a supported level.

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Spectrum Protect for Databases: Data Protection for Oracle version 8.1 | IBM Spectrum Protect Client/API version 8.1.
IBM Spectrum Protect for Databases (formerly Tivoli Storage Manager for Databases): Data Protection for Oracle version 7.1 | IBM Spectrum Protect (formerly Tivoli Storage Manager) Client/API version 7.1
Tivoli Storage Manager for Databases: Data Protection for Oracle version 6.4 and below are EOS. IBM recommends upgrading to a supported level. | Tivoli Storage Manager Client/API version 6.4 and below are EOS. IBM recommends upgrading to a supported level.

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Spectrum Protect for Mail: Data Protection for Microsoft Exchange Server version 8.1 | IBM Spectrum Protect Client/API version 8.1.
IBM Spectrum Protect for Mail (formerly Tivoli Storage Manager for Mail): Data Protection for Microsoft Exchange Server version 7.1 | IBM Spectrum Protect (formerly Tivoli Storage Manager) Client/API version 7.1
Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server version 6.4 and below are EOS. IBM recommends upgrading to a supported level. | Tivoli Storage Manager Client/API version 6.4 and below are EOS. IBM recommends upgrading to a supported level.

Principal Product and Version(s)

| Affected Supporting Product and Version
—|—
IBM Spectrum Protect for Mail (formerly Tivoli Storage Manager for Mail): Data Protection for Domino version 7.1 | IBM Spectrum Protect (formerly Tivoli Storage Manager) Client/API version 7.1
Tivoli Storage Manager for Mail: Data Protection for Domino version 6.4 and below are EOS. IBM recommends upgrading to a supported level. |

Tivoli Storage Manager Client/API version 6.4 and below are EOS. IBM recommends upgrading to a supported level.

Remediation/Fixes

Refer to the security bulletin Denial of Service vulnerability affects IBM Spectrum Protect Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-1786).

Workarounds and Mitigations

Refer to the security bulletin Denial of Service vulnerability affects IBM Spectrum Protect Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-1786).