IT04251: CONFIDENTIAL DATA EXPOSURE WHEN RESTORING MICROSOFT EXCHANGE MAILBOXES WHICH HAVE THE SAME ALIAS DEFINED CVE-2015-4950

Download Information: Version 4.1.1 Tivoli Storage FlashCopy Manager

APAR status

• Closed as program error.

Error description

• *VULNERABILITY SUMMARY*
  
  In environments with duplicated mailbox aliases, FlashCopy
  Manager for Microsoft Exchange and Data Protection for
  Microsoft Exchange may open and restore the wrong
  mailbox.
  
  *VULNERABILITY DETAILS*
  
  IBM Tivoli Storage FlashCopy Manager, Tivoli Storage Manager for
  Mail, and Tivoli Storage Manager FastBack for Microsoft Exchange
  could allow a local user with elevated privileges to obtain
  sensitive information by manipulating mailbox names that share
  the same alias.
  
  For example:
  
  Mailbox Display Name Alias
  mailbox1             Sales
  mailbox2             sales
  
  When two mailboxes have the same alias, users may encounter the
  following problems when using affected software:
  
  - the Mailbox Restore Browser interface may populate mailboxes
  with the folders and messages from a different mailbox than
  the one intended
  
  - restoring a mailbox via the CLI interface, using the alias
  instead of the mailbox display name, may restore a different
  mailbox than the one intended
  
  the mailbox history may not correctly represent the mailboxes
  that share the same alias
  

Local fix

• Use the Exchange Management Console or Powershell commands to
  rename the duplicated mailbox alias to a unique value.
  

Problem summary

• ****************************************************************
  USERS AFFECTED
  .
  All users of :
  .
  - Tivoli Storage Manager for Mail: Data Protection for Microsoft
  Exchange Server 6.1, 6.3, 6.4, and 7.1
  .
  
  .
  who have more than one mailbox display name using the same
  alias.
  ****************************************************************
  PROBLEM DESCRIPTION
  .
  See ERROR DESCRIPTION
  .
  
  
  For additional details, refer to the security bulleting
  published here:
  http://www.ibm.com/support/docview.wss?uid=swg21963629
  ****************************************************************
  RECOMENDATION:
  .
  Apply fixing level when available. This fix is currently
  projected to be available in:
  .
  
  - Tivoli Storage Manager for Mail: Data Protection for Microsoft
  Exchange Server 6.1.3.6, 6.3.1.3, 6.4.1.4, and 7.1.0.2
  
  - Tivoli Storage FlashCopy Manager for Microsoft Exchange Server
  3.1.1.5, 3.2.1.7, 4.1.1
  .
  
  
  
  
  Note for FlashCopy Manager 2.1 and 2.2 customers: FlashCopy
  Manager customers may install and use a fixed level of the
  Tivoli Storage Manager for Mail: Data Protection for Exchange
  component fix in their environment. The Data Protection for
  Microsoft Exchange fix provides equivalent functionality to
  FlashCopy Manager for Microsoft Exchange when used in FlashCopy
  Manager environment.
  .
  .
  FlashCopy Manager 2.1 customers can use the Data Protection for
  Exchange 6.1.3.6 fix
  .
  FlashCopy Manager 2.2 customers can use the Data Protection for
  Exchange 6.1.3.6 fix
  .
  FlashCopy Manager 3.1 customers can use the Data Protection for
  Exchange 6.3.1.3 fix
  FlashCopy Manager 3.2 customers can use the Data Protection for
  Exchange 6.4.1.4 fix
  .
  Note: This information is subject to change at the discretion of
  IBM.
  ****************************************************************
  

Problem conclusion

• Data Protection for Microsoft Exchange Server and FlashCopy
  Manager for Microsoft Exchange have been updated to correctly
  handle restore mailboxes have duplicated aliases.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IT04252

Modules/Macros

• TDPECXX
  

Fix information

• Fixed component name

  TDP EXCHANGE WI

• Fixed component ID

  5698DPXAP

Applicable component levels

• R71W PSY

     UP

• R64W PSY

     UP

• R63W PSY

     UP