PT-2017-2638 · Emc · Emc Vnx2+2

Published 2017-06-19 · Updated 2017-06-29 · CVE-2017-4984

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC VNX2 versions prior to 8.1.9.211 EMC VNX1 versions prior to 7.1.80.8

Description The issue is related to a lack of input sanitization, which may allow an unauthenticated remote attacker to elevate their permissions to root through a command injection, potentially leading to remote code execution. This could enable an attacker to run arbitrary code with root-level privileges on the targeted VNX Control Station system.

Recommendations For EMC VNX2 versions prior to 8.1.9.211, update to version 8.1.9.211 or later to resolve the issue. For EMC VNX1 versions prior to 7.1.80.8, update to version 7.1.80.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the VNX Control Station system to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2017-01865

CVE-2017-4984

Affected Products

Emc Vnx1

Emc Vnx2

Vnx Control Station

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-4984 · Security Note
• https://bdu.fstec.ru/vul/2017-01865 · Security Note
• http://securityfocus.com/bid/99039 · Note
• http://securityfocus.com/archive/1/540738/30/0/threaded · Note