The IBM Tivoli Provisioning Manager for OS Deployment (TPMfOSD) contains a buffer overflow vulnerability in the web server component. This vulnerability may allow an attacker to execute arbitrary code with SYSTEM privileges or cause a denial of service.
IBM Tivoli Provisioning Manager for OS Deployment (TPMfOSD) is a network boot server that facilitates central management of networked workstations. IBM TPMfOSD contains a buffer overflow vulnerability within the logging functionality of the web server component. A remote, unauthenticated attacker may be able to exploit this vulnerability by sending a specially crafted HTTPS (443/TCP) request to a target machine.
A remote, unauthenticated attacker could execute arbitrary code with SYSTEM privileges or crash the server process, causing a denial of service.
Apply an Update
IBM has released Interim Fix 3 Version 22.214.171.124 to address this issue.
IBM Corporation Affected
Updated: March 06, 2008
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see http://www-1.ibm.com/support/docview.wss?uid=swg24018010.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Thanks to iDefense Labs for reporting this vulnerability.
This document was written by John Hollenberger.
|Date First Published:||2008-03-06|
|Date Last Updated:||2008-03-06 15:36 UTC|