PT-2018-10978 · Dell Emc · Dell Emc Data Protection Advisor

Published 2018-03-12 · Updated 2018-04-13 · CVE-2018-1206

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110

Description The issue concerns a hardcoded database account with administrative privileges, specifically the account apollosuperuser. An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. It is noted that the Datastore Service database cannot be accessed remotely using this account.

Recommendations For Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159, update to version 6.3 Patch 159 or later. For Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110, update to version 6.4 Patch 110 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-1206

Affected Products

Dell Emc Data Protection Advisor

References · 5

• https://osv.dev/vulnerability/CVE-2018-1206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1206 · Security Note
• http://seclists.org/fulldisclosure/2018/Mar/22 · Note
• http://securitytracker.com/id/1040484 · Note
• http://securityfocus.com/bid/103376 · Note