PT-2017-13432 · Emc · Emc Isilon Onefs
Publicado
2017-12-13
·
Atualizado
2019-10-03
·
CVE-2017-14380
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
EMC Isilon OneFS versions 7.1.1.x
EMC Isilon OneFS versions 7.2.0.x
EMC Isilon OneFS versions 7.2.1.0 through 7.2.1.5
EMC Isilon OneFS versions 8.0.0.0 through 8.0.0.4
EMC Isilon OneFS versions 8.0.1.0 through 8.0.1.1
EMC Isilon OneFS version 8.1.0.0
Description
A malicious compliance admin (compadmin) account user could exploit a vulnerability in
isi get itrace or isi get profile maintenance scripts to run any shell script as system root on a cluster in compliance mode. This could potentially lead to an elevation of privilege for the compadmin user and violate compliance mode.Recommendations
For EMC Isilon OneFS version 7.1.1.x, consider disabling the
isi get itrace and isi get profile maintenance scripts until a patch is available.
For EMC Isilon OneFS version 7.2.0.x, consider disabling the isi get itrace and isi get profile maintenance scripts until a patch is available.
For EMC Isilon OneFS versions 7.2.1.0 through 7.2.1.5, consider disabling the isi get itrace and isi get profile maintenance scripts until a patch is available.
For EMC Isilon OneFS versions 8.0.0.0 through 8.0.0.4, consider disabling the isi get itrace and isi get profile maintenance scripts until a patch is available.
For EMC Isilon OneFS versions 8.0.1.0 through 8.0.1.1, consider disabling the isi get itrace and isi get profile maintenance scripts until a patch is available.
For EMC Isilon OneFS version 8.1.0.0, consider disabling the isi get itrace and isi get profile maintenance scripts until a patch is available.Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Emc Isilon Onefs