PT-2016-4474 · Emc · Avamar Server+2

Publicado 2016-09-21 · Atualizado 2017-07-30 · CVE-2016-0921

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233

Description The issue concerns weak permissions for unspecified directories in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE), allowing local users to gain root access. This can be achieved by replacing a script with a Trojan horse program, enabling unauthorized access and control.

Recommendations For versions prior to 7.3.0-233, update to version 7.3.0-233 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-0921

Produtos afetados

Avamar Data Store

Avamar Server

Avamar Virtual Edition

Referências · 5

• http://seclists.org/bugtraq/2016/Sep/31 · Nota
• https://osv.dev/vulnerability/CVE-2016-0921 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0921 · Nota de Segurança
• http://securitytracker.com/id/1036844 · Nota
• http://securityfocus.com/bid/93032 · Nota