Back to CVE Browser

CVE-2007-1868

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0970%

EPSS Percentile8.41th

PublishedApr 4, 2007

Last ModifiedApr 23, 2026

Vulnerability Description

The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via crafted POST requests to port 8080/tcp or 443/tcp.

Affected Platforms (CPE)

📦

Ibm

Tivoli Provisioning Manager Os Deployment

= 5.1.0.116

References & Advisories

🔗 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=498

🔗 http://secunia.com/advisories/24717

🔗 http://www-1.ibm.com/support/docview.wss?uid=swg24015347

🔗 http://www.securityfocus.com/bid/23264

🔗 http://www.securitytracker.com/id?1017840

🔗 http://www.vupen.com/english/advisories/2007/1199

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/33384

🔗 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=498

Related Vulnerabilities

CVE-2008-040110.0

Buffer overflow in the logging functionality of the HTTP server in IBM Tivoli Provisioning Manager for OS Deployment (TPMfOSD) bef...

CVE-2007-32687.5

The TFTP implementation in IBM Tivoli Provisioning Manager for OS Deployment 5.1 before Fix Pack 3 allows remote attackers to caus...

CVE-2010-41217.5

The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL state...

CVE-2007-182210.0

Alcatel-Lucent Lucent Technologies voice mail systems allow remote attackers to retrieve or remove messages, or reconfigure mailbo...