PT-2018-10844 · Emc · Boxmgmt Cli+2

Alexander Gonzalez + 3 · Publicado 2018-02-03 · Atualizado 2021-05-24 · CVE-2018-1184

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC RecoverPoint for Virtual Machines versions prior to 5.1.1 EMC RecoverPoint version 5.1.0.0 EMC RecoverPoint versions prior to 5.0.1.3

Description An issue was discovered that allows a malicious user with boxmgmt privileges to bypass Boxmgmt CLI and run arbitrary commands with root privileges due to a command injection vulnerability in Boxmgmt CLI.

Recommendations For EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, update to version 5.1.1 or later. For EMC RecoverPoint version 5.1.0.0, update to a version later than 5.1.0.0. For EMC RecoverPoint versions prior to 5.0.1.3, update to version 5.0.1.3 or later. As a temporary workaround, consider restricting access to the Boxmgmt CLI to minimize the risk of exploitation.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-1184

Produtos afetados

Boxmgmt Cli

Emc Recoverpoint

Dell Recoverpoint For Virtual Machines

Referências · 5

• https://t.me/cvenotify/14917 · Publicação no Telegram
• http://securitytracker.com/id/1040320 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1184 · Nota de Segurança
• http://seclists.org/fulldisclosure/2018/Feb/9 · Correção
• https://osv.dev/vulnerability/CVE-2018-1184 · Aviso do Fabricante