COMMAND
	Tivoli Storage Manager webserver buffer overflow (client & server)
SYSTEMS AFFECTED
	Tivoli Storage Manager version 4.2.x.x.
PROBLEM
	Patrik     Karlsson     &     Jonas     Ländin     of     iXsecurity
	[http://www.ixsecurity.com] reported :
	 Client side
	 ===========
	A request for  the  URL  A.AAAAA....approximately_1292_more_A's  to  the
	webserver running on port 1581 (TSM Client Acceptor) will  result  in  a
	crash, overwriting EIP. The buffer overwriting EIP is  in  a  widestring
	format, making it a little more difficult, although not  impossible,  to
	exploit.
	-Also-
	 Server side
	 ===========
	The  webserver  bound  to  1580  (dsmsvc.exe)  has  a  buffer   overflow
	condition. If an attacker would login, using  the  login  form,  with  a
	username of approx. 1976 characters long, he would overwrite  EIP.  This
	would lead to the service crashing, and  the  possibility  of  arbitrary
	code execution.
SOLUTION
	Apply Patches V4.2.1.32 from :
	
	http://www.tivoli.com/support/storage_mgr/clients.html
	
	and patch V4.2.1.15 from :
	
	http://www.tivoli.com/support/storage_mgr/servers.html