PT-2015-1389 · Emc · Emc Unisphere For Vmax

Published 2015-06-29 · Updated 2016-12-28 · CVE-2015-0545

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Unisphere for VMAX versions 8.0.0 through 8.0.3.3

Description The issue is related to the setup of the Java Debugging Wire Protocol (JDWP) service in EMC Unisphere for VMAX, which allows remote attackers to execute arbitrary code. The vulnerability is associated with errors in the code.

Recommendations For versions 8.0.0 through 8.0.3.3, update to version 8.0.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the JDWP service until a patch is available. Restrict access to the JDWP service to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2015-10484

CVE-2015-0545

Affected Products

Emc Unisphere For Vmax

References · 4

• https://bdu.fstec.ru/vul/2015-10484 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0545 · Security Note
• http://securitytracker.com/id/1032732 · Note
• http://seclists.org/bugtraq/2015/Jun/129 · Note