PT-2008-2279 · Emc · Emc Documentum Administrator+1

Pablo Gaston Milano · Published 2008-02-07 · Updated 2018-10-15 · CVE-2008-0656

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum Administrator version 5.3.0.313 EMC Documentum Webtop version 5.3.0.317

Description The issue allows remote attackers to overwrite arbitrary files via the filename attribute in the dmclTrace.jsp file. This can be exploited by uploading files with malicious intent.

Recommendations For EMC Documentum Administrator version 5.3.0.313, restrict access to the dmclTrace.jsp file to prevent unauthorized file uploads. For EMC Documentum Webtop version 5.3.0.317, restrict access to the dmclTrace.jsp file to prevent unauthorized file uploads. As a temporary workaround, consider disabling the file upload functionality in the dmclTrace.jsp file until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-0656

Affected Products

Emc Documentum Administrator

Emc Documentum Webtop

References · 9

• http://secunia.com/advisories/28810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0656 · Security Note
• http://securityfocus.com/archive/1/487603/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0656 · Note
• http://vupen.com/english/advisories/2008/0439 · Note
• http://securityfocus.com/bid/27632 · Note
• http://securityreason.com/securityalert/3626 · Note
• http://cybsec.com/vuln/CYBSEC-Security_Advisory_Documentum_dmclTrace_Arbitrary_file_overwrite.pdf · Note
• http://securitytracker.com/id?1019305 · Note