IBM TSM for Virtual Environments 7.1.3.0 < 7.1.6.4 Windows Domain Credential Disclosure

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(97141);
  script_version("1.5");
  script_cvs_date("Date: 2019/01/04  8:36:16");

  script_cve_id("CVE-2016-6034");

  script_name(english:"IBM TSM for Virtual Environments 7.1.3.0 < 7.1.6.4 Windows Domain Credential Disclosure");
  script_summary(english:"Checks the version of TSM for Virtual Environments.");

  script_set_attribute(attribute:"synopsis", value:
"A backup application installed on the remote host is affected by a
credential disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The IBM Tivoli Storage Manager (TSM) for Virtual Environments
installed on the remote host is a version later than 7.1.3.0 but prior
to 7.1.6.4. It is, therefore, affected by an unspecified flaw in the
vSphere GUI that allows an authenticated, remote attacker to disclose
Windows domain credentials.");
  script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg21995544");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Tivoli Storage Manager for Virtual Environments version
7.1.6.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-6034");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/12/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/02/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:tivoli_storage_manager_for_virtual_environments");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:spectrum_protect_for_virtual_environments");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies(
    "tivoli_storage_manager_virtual_environments_installed.nbin",
    "tivoli_storage_manager_virtual_environments_installed_linux.nbin"
  );
  script_require_keys("installed_sw/Tivoli Storage Manager for Virtual Environments");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("install_func.inc");

app = 'Tivoli Storage Manager for Virtual Environments';
fix = '7.1.6.4';
min = '7.1.3.0';

install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
version = install["version"];
path = install["path"];
hypervisor = install["Hypervisor"];

app += " for " + hypervisor;

if (hypervisor != "VMware")
  audit(AUDIT_INST_VER_NOT_VULN, app, version);

if (ver_compare(ver:version, fix:fix, minver:min, strict:FALSE) >= 0)
  audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);

# Differentiate Linux vs Windows
if (get_kb_item("SMB/Registry/Enumerated"))
  port = get_kb_item("SMB/transport");
else
  port = 0;

report =
  '\n  Hypervisor        : ' + hypervisor +
  '\n  Path              : ' + path +
  '\n  Installed version : ' + version +
  '\n  Fixed version     : ' + fix + '\n';
security_report_v4(port:port, extra:report, severity:SECURITY_WARNING);