PT-2014-6032 · Emc · Emc Documentum Content Server

Publicado 2014-12-17 · Atualizado 2014-12-17 · CVE-2014-4626

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP1 P29 EMC Documentum Content Server versions 6.7 SP2 prior to P18 EMC Documentum Content Server versions 7.0 prior to P16 EMC Documentum Content Server versions 7.1 prior to P09

Description The issue allows remote authenticated users to gain privileges. This can be achieved by placing a command in a dm job object and setting its owner to a privileged user. Alternatively, it can be done by placing a rename action in a dm job request object and waiting for a dm UserRename or dm GroupRename service task. The issue exists due to an incomplete fix for a previous problem.

Recommendations For versions prior to 6.7 SP1 P29, update to 6.7 SP1 P29 or later. For versions 6.7 SP2 prior to P18, update to 6.7 SP2 P18 or later. For versions 7.0 prior to P16, update to 7.0 P16 or later. For versions 7.1 prior to P09, update to 7.1 P09 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-4626

Produtos afetados

Emc Documentum Content Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-4626 · Nota de Segurança
• http://kb.cert.org/vuls/id/315340 · Nota
• http://kb.cert.org/vuls/id/386056 · Nota
• https://docs.google.com/spreadsheets/d/1DiiUPCPvmaliWcfwPSc36y2mDvuidkDKQBWqaIuJi0A/edit?usp=sharing · Nota
• http://kb.cert.org/vuls/id/874632 · Nota