PT-2012-3927 · Emc · Emc Networker

Published 2012-09-04 · Updated 2013-03-06 · CVE-2012-2288

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC NetWorker versions 7.6.3 through 7.6.4 EMC NetWorker versions 8.0 through 8.0.0.0

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in a message. This is due to a format string vulnerability in the nsrd RPC service.

Recommendations For EMC NetWorker versions 7.6.3 through 7.6.4, update to version 7.6.4.1 or later. For EMC NetWorker versions 8.0 through 8.0.0.0, update to version 8.0.0.1 or later.

Exploit

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2012-2288

Affected Products

Emc Networker

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/emc/networker_format_string.rb · Exploit
• 🔥 https://exploit-db.com/exploits/22525 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2288 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2288 · Note
• http://securityfocus.com/bid/55330 · Note
• http://securitytracker.com/id?1027459 · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-08/0219.html · Note