PT-2018-5915 · Emc · Emc Avamar Server+2

Michael Cramer · Published 2018-01-05 · Updated 2018-01-18 · CVE-2017-15549

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: EMC Avamar Server versions 7.1.x through 7.5.0 EMC NetWorker Virtual Edition (NVE) versions 9.0.x through 9.2.x EMC Integrated Data Protection Appliance version 2.0

Description: A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted files in any location on the server file system.

Recommendations: For EMC Avamar Server versions 7.1.x through 7.5.0, restrict access to file upload functionality to minimize the risk of exploitation. For EMC NetWorker Virtual Edition (NVE) versions 9.0.x through 9.2.x, consider disabling file upload features until a fix is available. For EMC Integrated Data Protection Appliance version 2.0, limit user privileges to prevent unauthorized file uploads.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-15549

Affected Products

Emc Avamar Server

Emc Integrated Data Protection Appliance

Emc Networker Virtual Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-15549 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15549 · Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Jan/17 · Note
• http://securitytracker.com/id/1040070 · Note
• http://securityfocus.com/bid/102363 · Note