CVE-2016-6043 Auth bypass in Tivoli Storage Manager Extended Edition

What is CVE-2016-6043?

CVE-2016-6043 is a high-severity authentication bypass vulnerability in IBM Corporation Tivoli Storage Manager Extended Edition, published on 1 Feb 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced.

Weakness: CWE-384

Which versions are affected by CVE-2016-6043?

It affects 1 product.

Products include Ibm Tivoli Storage Manager.

How do I fix CVE-2016-6043?

No fix has been published for CVE-2016-6043 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2016-6043 being exploited?

There is no known exploitation of CVE-2016-6043 in the wild and no public exploit code.

Other vulnerabilities in IBM Corporation Tivoli Storage Manager Extended Edition

• CVE-2009-3854 Memory corruption in n/a Critical 10.0
• CVE-2009-1178 Other in n/a Critical 10.0
• CVE-2008-4563 Memory corruption in n/a Critical 10.0
• CVE-2006-5855 Memory corruption in n/a Critical 10.0
• CVE-2016-8937 Information disclosure in Spectrum Protect Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4mh4-9h6c-9mc5.