Expert GuideIBM Storage Protect for Virtual Environments: Data Protection for VMware may be affected by vulnerabilities

Andreas Schwab — 13. October 2023
Reading time: 1:05 Minutes

IBM Storage Protect für virtuelle Umgebungen: Data Protection for VMware kann von Sicherheitslücken in der Expat-Bibliothek betroffen sein.

Security Bulletin: Vulnerabilities in Expat (AKA libexpat) affect IBM Storage Protect for Virtual Environments: Data Protection for VMware (CVE-2022-23852, CVE-2022-23990)

IBM Storage Protect for Virtual Environments (formerly IBM Spectrum Protect)

Data Protection for VMware may be affected by vulnerabilities in the Expat library in IBM Storage Protect for Virtual Environments.

 

The vulnerabilities could lead to the execution of arbitrary code as described in the CVEs in the Vulnerability Details section.

 

The vulnerabilities have been fixed.

Vulnerability Details

CVEID: CVE-2022-23990

CVSS base score: 9.8

 

DESCRIPTION: Expat (also known as libexpat) could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the doProlog function.

 

By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

 

CVEID: CVE-2022-23852

CVSS base score: 9.8

 

DESCRIPTION: Expat (also known as libexpat) could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the XML_GetBuffer function.

 

By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Expat version 2.4.4 solves the problem

The Expat (libexpat) vulnerability has been closed in version 2.4.4, which is deployed as of IBM Storage Protect for Virtual Environment version 8.1.15.

Affected platform:

Windows

Affected product and versions:

IBM Storage Protect for Virtual Environments: Data Protection for VMware Version 8.1.0.0 - 8.1.14.0

 

Fixing Level: 8.1.15.0 or later

IBM's recommended action: Update IBM Storage Protect for Virtual Environment to V 8.1.20.0

IBM strongly recommends updating to the latest version 8.1.20.0, which has been available since September 16, 2023.

 

IBM FTP Download Links V 8.1.20.0:

https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/tivoli-data-protection/vmware/windows/v8120/

 

IBM FTP Download Links V 8.1.15.0: https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/tivoli-data-protection/vmware/windows/v8115/

 

For more download information on IBM Storage Protect for Virtual Environments version 8.1.20, visit the following link:

https://www.ibm.com/support/pages/node/7015823

Source

https://www.ibm.com/support/pages/node/7050952?myns=s033&mynp=OCSSERB6&mync=E&cm_sp=s033-_-OCSSERB6-_-E

Andreas Schwab

Andreas Schwab

Andreas Schwab ist IT-Consultant und Senior Service Engineer bei der Empalis. Seit drei Jahren bereichert er unser Managed Service Team mit über 25 Jahren Erfahrung und Know-how aus der Systemadministration - vom Aufbau über Weiterentwicklung bis hin zu Betrieb der gesamten IBM Spectrum Protect Umgebung (Client und Server).

You were interested in this, then you may also be interested in...