PT-2009-1209 · Emc · Emc Documentum Applicationxtender Workflow

Stephen Fewer · Published 2009-10-22 · Updated 2009-11-20 · CVE-2008-3685

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Documentum ApplicationXtender Workflow versions prior to 5.40 SP1

Description The issue allows remote attackers to upload arbitrary files and execute arbitrary code via directory traversal sequences in requests to TCP port 2606. This is due to a directory traversal vulnerability in the aws tmxn.exe component of the Admin Agent service.

Recommendations For versions prior to 5.40 SP1, update to a version that includes the fix for this issue to prevent remote attackers from uploading arbitrary files and executing arbitrary code.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3685

Affected Products

Emc Documentum Applicationxtender Workflow

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2008-3685 · Security Note
• http://secunia.com/advisories/37070 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-08-095 · Note