Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client

1) Improper input validation

EUVDB-ID: #VU98644

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21235

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU98648

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21217

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU98645

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21210

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU98647

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21208

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Integer overflow

EUVDB-ID: #VU101344

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-10917

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to return of an incorrect value which has wrapped around by the JNI function GetStringUTFLength. A remote attacker can pass specially crafted data to the application, trigger integer overflow and bypass security restrictions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU111136

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-1470

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to some OMR internal port library and utilities consumers of z/OS atoe functions do not check their return values for NULL memory pointers or for memory allocation failures. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds write

EUVDB-ID: #VU111137

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-1471

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string and arguments are larger than the buffer size then buffer overflow occurs. A remote attacker can send a specially crafted file, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource management error

EUVDB-ID: #VU100259

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47535

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an unsafe reading of an environment file on Windows. A local user can create an overly large file and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource exhaustion

EUVDB-ID: #VU103769

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-25193

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application attempts to load a file that does not exist. A local user can create a large file on the system and crash the application.

Note, the vulnerability affects Windows installations only.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU98137

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2024-40094

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to GraphQL Java (aka graphql-java) does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

11) Resource exhaustion

EUVDB-ID: #VU105112

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-23184

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in CachedOutputStream instances allowing creation of enormous amount of temporary files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Storage Protect Backup-Archive Client: 8.1.0 - 8.1.26

CPE2.3

• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:storage_protect_backup-archive_client:8.1.2:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7237492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.