PT-2011-2268 · Emc · Emc Networker

Published 2011-02-01 · Updated 2017-08-17 · CVE-2011-0321

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions EMC NetWorker versions prior to 7.5 SP4 EMC NetWorker versions 7.5.3.x prior to 7.5.3.5 EMC NetWorker versions 7.6.x prior to 7.6.1.2

Description The issue allows remote attackers to cause a denial of service or obtain sensitive information from interprocess communication by sending crafted UDP packets containing service commands. This is due to the failure of librpc.dll in nsrexecd to properly mitigate the possibility of a spoofed localhost source IP address, enabling attackers to register or unregister RPC services.

Recommendations For versions prior to 7.5 SP4, update to version 7.5 SP4 or later. For versions 7.5.3.x prior to 7.5.3.5, update to version 7.5.3.5 or later. For versions 7.6.x prior to 7.6.1.2, update to version 7.6.1.2 or later.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-0321

ZDI-11-168

Affected Products

Emc Networker

References · 11

• http://vupen.com/english/advisories/2011/0241 · Vendor Advisory
• http://secunia.com/advisories/43113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0321 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-11-168 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64997 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0321 · Note
• http://osvdb.org/70686 · Note
• http://archives.neohapsis.com/archives/bugtraq/2011-01/0162.html · Note
• http://securitytracker.com/id?1025010 · Note
• http://archives.neohapsis.com/archives/bugtraq/2011-01/att-0162/ESA-2011-003.txt · Note
• http://securityfocus.com/bid/46044 · Note