PT-2015-3072 · Western Digital · Arkeia

Xistence · Publicado 2015-10-05 · Atualizado 2015-10-06 · CVE-2015-7709

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Western Digital Arkeia versions 11.0.12 and earlier

Description The issue is related to insufficient access control in the arkeiad daemon of the Arkeia Backup Agent, allowing remote attackers to bypass authentication. Attackers can execute arbitrary commands by sending a series of crafted requests involving the ARKFS EXEC CMD operation.

Recommendations For Western Digital Arkeia versions 11.0.12 and earlier, consider restricting access to the arkeiad daemon to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the ARKFS EXEC CMD operation in the affected daemon until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-00277

CVE-2015-7709

Produtos afetados

Arkeia

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/arkeia_agent_exec.rb · Exploit
• 🔥 https://packetstormsecurity.com/files/132660/Western-Digital-Arkeia-11.0.13-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/37600 · Exploit
• 🔥 http://rapid7.com/db/modules/exploit/multi/misc/arkeia_agent_exec · Exploit
• https://bdu.fstec.ru/vul/2016-00277 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-7709 · Nota de Segurança