Unscored severity · published Aug 23, 2015
CVE-2015-6557
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage…
–
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before 6.1.3.7, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; and Tivoli Storage FlashCopy Manager 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.2, when application tracing is used, place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading trace output, a different vulnerability than CVE-2015-4949.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tivoli Storage Flashcopy Manager · Ibm
3.1.0; 3.1.1; 3.2.0; 3.2.1; 4.1.0; 4.1.1 · source: NVD
TS
Tivoli Storage Manager For Databases Data Protection For Microsoft Sql Server · Ibm
5.5; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +7 more · source: NVD
TS
Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server · Ibm
5.5; 5.5.1; 6.1; 6.1.1; 6.1.2; 6.1.3; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6557
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6557
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT03480
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21963630
More from Tivoli Storage Flashcopy Manager
–
CVE-2015-7404
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka Spectrum Protect for Databases) 5.5 before 5.5.6.2, 6.3 before 6.3.1.6, 6.4 before 6.4.1.8,…
–
CVE-2015-1988
Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before…
–
CVE-2015-4949
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server…
–
CVE-2013-6714
The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations,…
–
CVE-2013-3976
The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) FlashCopy Manager for Exchange component…