PT-2017-3058 · Emc · Emc Elastic Cloud Storage

Published 2017-09-26 · Updated 2020-08-19 · CVE-2017-8021

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC Elastic Cloud Storage (ECS) versions prior to 3.1

Description The issue is related to an undocumented account vulnerability that could be leveraged by malicious users to compromise the system. It is also associated with the use of a pre-installed account, specifically emcservice, which has a predefined password. Exploitation of this issue may allow a remote attacker to access the system, compromising the confidentiality, integrity, and availability of data.

Recommendations For versions prior to 3.1, consider changing the password of the pre-installed emcservice account to prevent unauthorized access. As a temporary workaround, restrict access to the system to minimize the risk of exploitation until a patch is available. Update to version 3.1 or later to fully resolve the issue.

Fix

Weakness Enumeration

CWE-255

CWE-1188

Related Identifiers

BDU:2017-02427

CVE-2017-8021

Affected Products

Emc Elastic Cloud Storage

References · 6

• https://bdu.fstec.ru/vul/2017-02427 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8021 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8021 · Vendor Advisory
• https://packetstormsecurity.com/files/144375/EMC-Elastic-Cloud-Storage-Undocumented-Account.html · Note
• http://seclists.org/fulldisclosure/2017/Sep/74 · Note
• http://securityfocus.com/bid/101018 · Note