PT-2015-1298 · Netapp · Netapp Oncommand Workflow Automation

Publicado 2015-05-31 · Atualizado 2016-12-03 · CVE-2015-3292

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetApp OnCommand Workflow Automation versions prior to 2.2.1P1 NetApp OnCommand Workflow Automation versions 3.x prior to 3.0P1

Description The issue concerns the installer in NetApp OnCommand Workflow Automation, which sets up the Java Debugging Wire Protocol (JDWP) service. This setup allows remote attackers to execute arbitrary code via unspecified vectors. The JDWP service is used for debugging Java applications, but in this context, it introduces a security risk.

Recommendations For versions prior to 2.2.1P1, update to version 2.2.1P1 or later. For versions 3.x prior to 3.0P1, update to version 3.0P1 or later. As a temporary workaround, consider disabling the JDWP service until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

BDU:2015-10353

CVE-2015-3292

Produtos afetados

Netapp Oncommand Workflow Automation

Referências · 6

• 🔥 https://exploit-db.com/exploits/33789 · Exploit
• https://bdu.fstec.ru/vul/2015-10353 · Nota de Segurança
• https://kb.netapp.com/support/index?page=content&id=9010037 · Nota
• https://kb.netapp.com/support/index?page=content&id=9010037 · Aviso do Fabricante
• http://securityfocus.com/bid/74891 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3292 · Nota de Segurança