PT-2017-18072 · Emc · Emc Scaleio

Published 2017-11-28 · Updated 2017-12-15 · CVE-2017-8019

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EMC ScaleIO version 2.0.1.x

Description A vulnerability in message parsers, including MDM, SDS, and LIA, could potentially allow an unauthenticated remote attacker to send specifically crafted packets, causing a denial of service situation by stopping ScaleIO services.

Recommendations For EMC ScaleIO version 2.0.1.x, consider restricting access to the message parsers to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the vulnerable message parsers (MDM, SDS, and LIA) may help prevent the denial of service situation. However, this may impact the functionality of ScaleIO services. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-8019

Affected Products

Emc Scaleio

References · 4

• https://osv.dev/vulnerability/CVE-2017-8019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8019 · Security Note
• http://seclists.org/fulldisclosure/2017/Nov/35 · Note
• http://securityfocus.com/bid/101991 · Note