Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2146
Multiple vulnerabilities have been identified in EMC Data
Protection Advisor
28 August 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: EMC Data Protection Advisor
Publisher: EMC
Operating System: Windows
Linux variants
Virtualisation
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-8003 CVE-2017-8002
Original Bulletin:
http://www.zerodayinitiative.com/advisories/ZDI-17-711/
http://www.zerodayinitiative.com/advisories/ZDI-17-710/
http://www.zerodayinitiative.com/advisories/ZDI-17-709/
http://www.zerodayinitiative.com/advisories/ZDI-17-708/
Comment: This bulletin contains four (4) EMC security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
EMC Data Protection Advisor ScheduledReportResource Directory Traversal Information Disclosure Vulnerability
ZDI-17-711: August 25th, 2017
CVE ID
CVE-2017-8003
CVSS Score
6.8, (AV:N/AC:L/Au:S/C:C/I:N/A:N)
Affected Vendors
EMC
Affected Products
Data Protection Advisor
TippingPoint(TM) IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 28103. For further product information on the TippingPoint IPS:
http://www.tippingpoint.com
Vulnerability Details
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Data Protection Advisor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed.
The specific flaw exists within the EMC DPA Application service, which listens on TCP port 9002 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose any files accessible to the SYSTEM user.
Vendor Response
EMC has issued an update to correct this vulnerability. More details can be found at:
http://seclists.org/fulldisclosure/2017/Jul/12
Disclosure Timeline
2017-04-12 - Vulnerability reported to vendor
2017-08-25 - Coordinated public release of advisory
Credit
This vulnerability was discovered by:
rgod
- ---
EMC Data Protection Advisor RequestHistoryResource orderby SQL Injection Information Disclosure Vulnerability
ZDI-17-710: August 25th, 2017
CVE ID
CVE-2017-8002
CVSS Score
6.8, (AV:N/AC:L/Au:S/C:C/I:N/A:N)
Affected Vendors
EMC
Affected Products
Data Protection Advisor
TippingPoint(TM) IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 28105. For further product information on the TippingPoint IPS:
http://www.tippingpoint.com
Vulnerability Details
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Data Protection Advisor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed.
The specific flaw exists within the EMC DPA Application service, which listens on TCP port 9002 by default. When parsing the orderby request parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM.
Vendor Response
EMC has issued an update to correct this vulnerability. More details can be found at:
http://seclists.org/fulldisclosure/2017/Jul/12
Disclosure Timeline
2017-04-12 - Vulnerability reported to vendor
2017-08-25 - Coordinated public release of advisory
Credit
This vulnerability was discovered by:
rgod
- ---
EMC Data Protection Advisor ReportQueueResource orderby SQL Injection Information Disclosure Vulnerability
ZDI-17-709: August 25th, 2017
CVE ID
CVE-2017-8002
CVSS Score
6.8, (AV:N/AC:L/Au:S/C:C/I:N/A:N)
Affected Vendors
EMC
Affected Products
Data Protection Advisor
TippingPoint(TM) IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 28102. For further product information on the TippingPoint IPS:
http://www.tippingpoint.com
Vulnerability Details
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Data Protection Advisor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed.
The specific flaw exists within the EMC DPA Application service, which listens on TCP port 9002 by default. When parsing the orderby request parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM.
Vendor Response
EMC has issued an update to correct this vulnerability. More details can be found at:
http://seclists.org/fulldisclosure/2017/Jul/12
Disclosure Timeline
2017-04-12 - Vulnerability reported to vendor
2017-08-25 - Coordinated public release of advisory
Credit
This vulnerability was discovered by:
rgod
- ---
EMC Data Protection Advisor BaseRestEntityResource orderby SQL Injection Information Disclosure Vulnerability
ZDI-17-708: August 25th, 2017
CVE ID
CVE-2017-8002
CVSS Score
6.8, (AV:N/AC:L/Au:S/C:C/I:N/A:N)
Affected Vendors
EMC
Affected Products
Data Protection Advisor
TippingPoint(TM) IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 28104. For further product information on the TippingPoint IPS:
http://www.tippingpoint.com
Vulnerability Details
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Data Protection Advisor. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be easily bypassed.
The specific flaw exists within the EMC DPA Application service, which listens on TCP port 9002 by default. When parsing the orderby request parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM.
Vendor Response
EMC has issued an update to correct this vulnerability. More details can be found at:
http://seclists.org/fulldisclosure/2017/Jul/12
Disclosure Timeline
2017-04-12 - Vulnerability reported to vendor
2017-08-25 - Coordinated public release of advisory
Credit
This vulnerability was discovered by:
rgod
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWaO1lIx+lLeg9Ub1AQiESBAAo2wVAi4CcwuSX3gq8d05Wp6ZSpOtJoc3
H1nIHpdfG29FwilkOMZQmOWBbOZRkTtNXzRaHXx0zns1CfDYT//FdnnwmO6P+MD8
ntQ064/e1sPoXPrA08YCgvZUrR/IB4iNuPopjl/srZAo4HLvqrOQnNQ2itVu6MXU
MoSZwcBEYfZpAr6dnizTalvsaqopUsTXAQ1PmKQcsnRmlxctSsIEq+2wvfNeKwda
FeW1eDnpl2ej6+bH7gSvcUESGXGOZKmojSDWxJpqFMm9tz1X9I4R5XllkNOLTgle
9BRdWsR5tLz6L0G3sBS7e/x3pcV9bY9gZ9QoiBoZd6zQXjta+MaYBVYZNUrZqlqW
zvqGUimFyzWJ6Z4b2vPR3BA2b+Nh26o3f35ZBOt7KtmUU2TmLHd0jBsG6uQBphz9
besusbrRn5zU3NZHkItFooL5tGkmQ5lMgik5RyB5Kn9Qr8Fkg4gbv+MZYK9N2Z6s
VPmQh8qeZ3Tgn/afeUD9CqIPLrEULGgdLcNoUJA9+xd5HD2aJ4RsVDkDZx/fF90U
ThRfwQQQiLt69nIfsM2GAI3ZdKCHs07A2SWSWRP+GLw9VpYQoI5GYXH8tG6NuV5G
F5rUbtwSGWy82Pb+uo1f9v8HIkMj0ZNA4SR+c8n/DYqPFnPHqBsDopZwMvn7rIAL
8Kt5rW3gIEQ=
=TN4S
-----END PGP SIGNATURE-----