Description:

IBM has released a security update to address several vulnerabilities in its products, the most ones:

• IBM Spectrum Copy Data Management
• IBM Telco Network Cloud Manager – Performance (TNCP)
• IBM Operations Analytics Predictive Insights
• IBM Spectrum Protect Snapshot for VMware
• IBM Spectrum Protect Plus
• SANnav
• App Connect Enterprise Certified Container
• IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
• IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
• IBM Spectrum Copy Data Management
• IBM Db2
• IBM Spectrum Protect Operations Center
• GDE (4.0.0.6)
• IBM Spectrum Protect Snapshot for Windows (formerly IBM Tivoli Storage FlashCopy Manager for Windows)
• IBM Tivoli Storage FlashCopy Manager for Windows
• IBM Sterling Connect Direct for Microsoft Windows
• IBM Connect Direct for Microsoft Windows
• z/Transaction Processing Facility
• TPF Operations Server
• IBM® QRadar
• IBM Spectrum Protect Backup-Archive Client – see Note 1
• IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
• IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V
• IBM Spectrum Protect for Space Management
• IBM App Connect Enterprise
• IBM Security Guardium Insights
• Db2 Big SQL
• Tivoli Composite Application Manager for Application Diagnostics
• IBM Spectrum Protect Snapshot for Windows (formerly IBM Tivoli Storage FlashCopy Manager for Windows)
• IBM Tivoli Storage FlashCopy Manager for Windows

Threats:

Attacker could exploit these vulnerabilities by doing the following:

• Execute Arbitrary Code

Best practice and Recommendations:

The CERT team encourages users to review IBM security advisory and apply the necessary updates:

• https://www.ibm.com/blogs/psirt/