PT-2007-3190 · Dell · Data Domain Os

Elliot Kendall · Published 2007-04-03 · Updated 2018-10-16 · CVE-2007-1836

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Data Domain OS versions prior to 4.0.3.6

Description: The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain arguments to various commands. This is demonstrated by the interface argument to the (1) ifconfig and (2) ping commands.

Recommendations: For versions prior to 4.0.3.6, update to version 4.0.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the command line administration interface to minimize the risk of exploitation. Avoid using shell metacharacters in arguments to commands such as ifconfig and ping until the issue is resolved.

Fix

Related Identifiers

CVE-2007-1836

Affected Products

Data Domain Os

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-1836 · Security Note
• http://secunia.com/advisories/24666 · Note
• http://osvdb.org/34537 · Note
• http://securityfocus.com/archive/1/464085/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33291 · Note
• http://securityreason.com/securityalert/2516 · Note
• http://securityfocus.com/bid/23182 · Note