PT-2018-10961 · Dell Emc · Isilon Onefs

Ivan Huertas + 1 · Published 2018-03-26 · Updated 2018-04-19 · CVE-2018-1204

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions 7.1.1.11 Dell EMC Isilon OneFS versions 7.2.1.x Dell EMC Isilon OneFS versions 8.0.0.0 through 8.0.0.6 Dell EMC Isilon OneFS versions 8.0.1.0 through 8.0.1.2 Dell EMC Isilon OneFS versions 8.1.0.0 through 8.1.0.1

Description A path traversal vulnerability exists in the isi phone home tool, potentially allowing a malicious compadmin to execute arbitrary code with root privileges.

Recommendations For version 7.1.1.11, update to a version that fixes the path traversal vulnerability in the isi phone home tool. For versions 7.2.1.x, update to a version that fixes the path traversal vulnerability in the isi phone home tool. For versions 8.0.0.0 through 8.0.0.6, update to a version that fixes the path traversal vulnerability in the isi phone home tool. For versions 8.0.1.0 through 8.0.1.2, update to a version that fixes the path traversal vulnerability in the isi phone home tool. For versions 8.1.0.0 through 8.1.0.1, update to a version that fixes the path traversal vulnerability in the isi phone home tool.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-1204

Affected Products

Isilon Onefs

References · 6

• 🔥 https://exploit-db.com/exploits/44039 · Exploit
• 🔥 https://coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1204 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1204 · Vendor Advisory
• http://securityfocus.com/bid/103033 · Note
• http://seclists.org/fulldisclosure/2018/Mar/50 · Note