CVE-2020-28198
📋 TL;DR
CVE-2020-28198 is a stack buffer overflow vulnerability in IBM Tivoli Storage Manager's administrative client (dsmadmc.exe) that allows attackers to execute arbitrary code or cause denial of service. The vulnerability affects only the interactive mode of the client when processing the 'id' parameter. This impacts organizations running unsupported IBM Tivoli Storage Manager Version 5 Release 2.
💻 Affected Systems
- IBM Tivoli Storage Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, privilege escalation, or installation of persistent malware.
Likely Case
Local privilege escalation or denial of service affecting the administrative client functionality.
If Mitigated
Limited impact due to interactive-only requirement and unsupported software status reducing attack surface.
🎯 Exploit Status
Exploit requires local access to execute the vulnerable client in interactive mode. Public exploit code exists for Windows x86 systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as product is end-of-life. Migrate to supported IBM Storage Protect or alternative solutions.
🔧 Temporary Workarounds
Disable Interactive Mode Usage
windowsEnforce policy to only use batch/command-line mode for administrative operations
Enforce administrative procedures to avoid using dsmadmc.exe interactively
Application Whitelisting
windowsBlock execution of dsmadmc.exe or restrict to specific administrative accounts
Use Windows AppLocker or similar to restrict dsmadmc.exe execution
🧯 If You Can't Patch
- Migrate to IBM Storage Protect (formerly Spectrum Protect) or alternative supported backup solution
- Isolate Tivoli administrative workstations on separate network segments with strict access controls
🔍 How to Verify
Check if Vulnerable:
Check if IBM Tivoli Storage Manager Version 5.2.0.1 is installed and dsmadmc.exe exists in the installation directoryCheck Version:
dsmadmc.exe -version or check installed programs in Windows Control PanelVerify Fix Applied:
Verify migration to supported software or removal of vulnerable version📡 Detection & Monitoring
Log Indicators:
- Unusual process crashes of dsmadmc.exe
- Multiple failed interactive login attempts to Tivoli client
SIEM Query:
Process creation where Image contains 'dsmadmc.exe' AND CommandLine contains 'interactive' patterns🔗 References
- https://github.com/VoidSec/Exploit-Development/blob/master/windows/x86/local/IBM_ITSM_Administrator_Client_v.5.2.0.1/IBM_TSM_v.5.2.0.1_exploit.py
- https://voidsec.com/tivoli-madness/#IBM_Tivoli_Storage_Manager
- https://github.com/VoidSec/Exploit-Development/blob/master/windows/x86/local/IBM_ITSM_Administrator_Client_v.5.2.0.1/IBM_TSM_v.5.2.0.1_exploit.py
- https://voidsec.com/tivoli-madness/#IBM_Tivoli_Storage_Manager
