Vulnerabilities Found In TSM Client!!!

(APARs IC52905 and IC53616)

Wow I'm glad I added the news section to the blog I saw this article about a possible exploit with the TSM CAD on client systems. I'd try to explain it but it's best to check the article. It can leave systems open for execution of arbitrary code. Check it out here and here. This exploit goes back as far as the 5.1 client so be aware of the issue even with older clients.

Affected Products:

IBM Tivoli Storage Manager Client version 5.1
IBM Tivoli Storage Manager Client version 5.2
IBM Tivoli Storage Manager Client version 5.3
IBM Tivoli Storage Manager Client version 5.4

Solution:

Apply client update package 5.4.1.2 (UK27738 and UK27739) :
http://www.ibm.com/support/docview.wss?uid=swg24016585

Apply client update package 5.3.5.3 (UK29248 and UK29249) :
http://www.ibm.com/support/docview.wss?uid=swg24016838

Apply client update packages 5.2.5.2 and 5.1.8.1 :
http://www.ibm.com/support/docview.wss?uid=swg24016985
http://www.ibm.com/support/docview.wss?uid=swg24016586

Original Advisory:
http://www-1.ibm.com/support/docview.wss?uid=swg21268775

Labels Explained

On the lower left column of the website you'll see the Labels header. These labels will help you speed up your searching for content on TSMExpert by narrowing the results and showing all posts that have that label assigned. Need to look for Shared Library articles click the label and you'll see all related posts. I hope it helps and if you don't see a label for what you are looking for Google search TSMExpert for it.

TSMExpert Changes

I have made a number of updates to the sites, mostly cosmetic, but I have also removed some of the contributors who have not submitted lately (last 3 months). If you have an item(s) you would like to contribute I will gladly add you to the contributors list. Send me an e-mail letting me know what item you would like to cover or experience you would like to share or get feedback.

Free Tivoli Web Based Training

If you are not aware of it, there is some good FREE web based training from Tivoli here. Also if you cannot afford, or take the time, for the regular class training they do have some decent low cost web based training for TSM and CDP (Continuous Data Protection) listed on the site also. Now it's not as thorough as the classroom training but if you have never used TSM it's a good start.

VSS Question

I was asked about Exchange backups today and after looking at some documentation I remembered that with Exchange 2003 there is a VSS backup option. For the life of me I can't think of anyone who has used it with their Exchange backups. Is there anyone out there who has attempted to use, or is using VSS with their Exchange TDP? I have never trusted it enough to rely on it for my Exchange backups. It has enough problems with the system objects, but since MS has had some time to work out the kinks has anyone been successful with it? Is it worth the hassle?

TSM Summary Table Question

So here is a question I hope someone can answer, does the SUMMARY table in the TSM DB track all backups whether they are scheduled or client initiated (cron or manually) or does it just track scheduled backups? Also does it track LAN-Free backups with data amounts? I figure it only tracks scheduled backups, but I haven't taken the time to look. If anyone cares to wager a guess or has the definitive answer please let me know.

Not so bad IBM article about...

...Tivoli Storage Manager Client Incremental Backup Memory Requirements