PT-2015-4702 · Emc · Emc Autostart

Published 2015-05-07 · Updated 2016-04-01 · CVE-2015-0538

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC AutoStart versions 5.4.x through 5.5.x before 5.5.0.508 HF4

Description The issue allows remote attackers to execute arbitrary commands via crafted packets. It involves SQL injection and command injection vulnerabilities in the ftagent.exe component of EMC AutoStart, specifically affecting various opcodes and subcodes, such as Opcode 83 Subcode 22, Opcode 20 Subcode 2060, Opcode 85 Subcode 33, and Opcode 20 Subcode 2219.

Recommendations For versions 5.4.x through 5.5.x before 5.5.0.508 HF4, update to version 5.5.0.508 HF4 or later to resolve the issue. As a temporary workaround, consider restricting access to the ftagent.exe component until a patch is applied. Avoid using the vulnerable opcodes and subcodes in the ftAgent protocol until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2015-0538

ZDI-15-171

ZDI-15-172

ZDI-15-173

ZDI-15-174

ZDI-15-175

Affected Products

Emc Autostart

References · 10

• https://zerodayinitiative.com/advisories/ZDI-15-171 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-174 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0538 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-175 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-172 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-173 · Security Note
• http://packetstormsecurity.com/files/131749/EMC-AutoStart-5.4.3-5.5.0-Packet-Injection.html · Note
• http://seclists.org/bugtraq/2015/May/25 · Note
• http://kb.cert.org/vuls/id/581276 · Note
• http://securitytracker.com/id/1032237 · Note