PT-2017-11634 · Emc · Emc Data Protection Advisor

Rgod · Published 2017-09-28 · Updated 2024-08-05 · CVE-2017-10955

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Data Protection Advisor version 6.3.0

Description This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is required to exploit this issue. The specific flaw exists within the EMC DPA Application service, which listens on TCP port 9002 by default. When parsing the preScript parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute arbitrary code under the context of SYSTEM.

Recommendations For EMC Data Protection Advisor version 6.3.0, consider disabling the EMC DPA Application service or restricting access to TCP port 9002 until a patch is available. As a temporary workaround, avoid using the preScript parameter in the affected service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2017-10955

ZDI-17-812

Affected Products

Emc Data Protection Advisor

References · 6

• https://zerodayinitiative.com/advisories/ZDI-17-812 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-10955 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10955 · Vendor Advisory
• http://securityfocus.com/bid/101008 · Note
• https://t.me/cvenotify/86354 · Telegram Post
• https://t.me/cvenotify/88222 · Telegram Post