PT-2013-2723 · Emc · Emc Alphastor

Published 2013-01-21 · Updated 2016-08-18 · CVE-2013-0929

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC AlphaStor versions 4.0 before build 800

Description The issue is related to a format string vulnerability in the vsnsprintf function in rrobotd.exe, part of the Device Manager in EMC AlphaStor. This vulnerability allows remote attackers to execute arbitrary code via format string specifiers in a command.

Recommendations For versions prior to build 800, update to build 800 or later to resolve the issue. As a temporary workaround, consider restricting access to the Device Manager to minimize the risk of exploitation.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2013-0929

ZDI-13-034

Affected Products

Emc Alphastor

References · 4

• https://zerodayinitiative.com/advisories/ZDI-13-034 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0929 · Security Note
• http://securityfocus.com/bid/57472 · Note
• http://archives.neohapsis.com/archives/bugtraq/2013-01/0078.html · Note