CVE-2018-1550 Privilege escalation in Spectrum Protect

What is CVE-2018-1550?

CVE-2018-1550 is a medium-severity vulnerability in IBM Spectrum Protect, published on 26 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users. IBM X-Force ID: 142696.

Weakness: CWE-269

Which versions are affected by CVE-2018-1550?

It affects 3 products.

Products include Ibm Tivoli Storage Manager, Ibm Tivoli Storage Manager for Space Management, Ibm Tivoli Storage Manager for Virtual Environments.

How do I fix CVE-2018-1550?

No fix has been published for CVE-2018-1550 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-1550 being exploited?

There is no known exploitation of CVE-2018-1550 in the wild and no public exploit code.

Other vulnerabilities in IBM Spectrum Protect

• CVE-2009-3854 Memory corruption in n/a Critical 10.0
• CVE-2009-1178 Other in n/a Critical 10.0
• CVE-2008-4563 Memory corruption in n/a Critical 10.0
• CVE-2006-5855 Memory corruption in n/a Critical 10.0
• CVE-2016-8937 Information disclosure in Spectrum Protect Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x5pr-fj3f-vq27.