PT-2017-2832 · Emc · Emc Storage M&R+3

Rgod · Published 2017-07-11 · Updated 2021-09-13 · CVE-2017-8011

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC ViPR SRM versions prior to 4.1 EMC Storage M&R versions prior to 4.1 EMC VNX M&R all versions EMC M&R (Watch4Net) for SAS Solution Packs all versions

Description The issue concerns undocumented accounts with default passwords for Webservice Gateway and RMI JMX components in certain EMC products. A remote attacker with knowledge of the default password may use these accounts to run arbitrary web service and remote procedure calls on the affected system. This could potentially allow an attacker to exploit the vulnerability and gain unauthorized access to the system.

Recommendations For EMC ViPR SRM versions prior to 4.1, update to version 4.1 or later to resolve the issue. For EMC Storage M&R versions prior to 4.1, update to version 4.1 or later to resolve the issue. For EMC VNX M&R, consider disabling the Webservice Gateway and RMI JMX components until a patch is available. For EMC M&R (Watch4Net) for SAS Solution Packs, restrict access to the default accounts to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2017-02112

CVE-2017-8011

ZDI-17-505

Affected Products

Emc M&R (Watch4Net) For Sas Solution Packs

Emc Storage M&R

Emc Vnx M&R

Emc Vipr Srm

References · 7

• https://osv.dev/vulnerability/CVE-2017-8011 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02112 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-505 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8011 · Security Note
• http://securityfocus.com/bid/99555 · Note
• http://seclists.org/fulldisclosure/2017/Jul/21 · Note
• http://securitytracker.com/id/1038905 · Note