PT-2017-18067 · Emc · Emc Data Protection Advisor

Rgod · Published 2017-09-15 · Updated 2018-04-13 · CVE-2017-8013

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC Data Protection Advisor versions 6.3.x through 6.4.x before patch 130 EMC Data Protection Advisor versions 6.3.x before patch 67

Description The issue concerns undocumented accounts with hard-coded passwords and various privileges. The affected accounts are "Apollo System Test", emc.dpa.agent.logon, and emc.dpa.metrics.logon. An attacker with knowledge of the password could potentially use these accounts via REST APIs to gain unauthorized access, including potentially administrative privileges.

Recommendations For EMC Data Protection Advisor versions 6.3.x before patch 67, apply patch 67 to resolve the issue. For EMC Data Protection Advisor versions 6.4.x before patch 130, apply patch 130 to resolve the issue. As a temporary workaround, consider restricting access to the REST APIs until a patch is applied.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-8013

ZDI-17-811

Affected Products

Emc Data Protection Advisor

References · 6

• https://osv.dev/vulnerability/CVE-2017-8013 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-811 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8013 · Security Note
• http://securityfocus.com/bid/100846 · Note
• http://seclists.org/fulldisclosure/2017/Sep/36 · Note
• http://securitytracker.com/id/1039370 · Note