-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
Authentication Bypass leading to Administrator Creation in
EMC VMAX Products
21 November 2017
AusCERT Security Bulletin Summary
Product: EMC VMAX Virtual Appliance
EMC Unisphere for VMAX Virtual Appliance
EMC Solutions Enabler vApp
EMC VASA vApp
EMC VMAX eManagement
Operating System: Virtualisation
Impact/Access: Administrator Compromise -- Remote/Unauthenticated
CVE Names: CVE-2017-14375
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
ESA-2017-137: EMC VMAX Virtual Appliance (vApp) Authentication Bypass Vulnerability
EMC Identifier: ESA-2017-137
CVE Identifier: CVE-2017-14375
Severity Rating: CVSSv3 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
*EMC Unisphere for VMAX Virtual Appliance versions prior to 184.108.40.206
*EMC Solutions Enabler Virtual Appliance versions prior to 220.127.116.11
*EMC VASA Virtual Appliance versions prior to 18.104.22.1682
*EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and
The vApp Manager which is embedded in EMC Unisphere for VMAX, Solutions Enabler, VASA Virtual Appliances, and EMC VMAX
Embedded Management (eManagement) contains an authentication bypass vulnerability that may potentially be exploited by
malicious users to compromise the affected system.
The vApp Manager contains a servlet that does not perform proper authentication checks before processing AMF messages
for user creation requests. A remote unauthenticated attacker, by having knowledge of the message format, may
potentially create new user accounts with administrative privileges, and then log in to the affected application.
The following VMAX products contain a resolution for this vulnerability:
ESX Server Installs:
*EMC Unisphere for VMAX Virtual Appliance 22.214.171.124 OVA
*EMC Unisphere for VMAX Virtual Appliance 126.96.36.199 ISO
*EMC Unisphere for VMAX Virtual Appliance 188.8.131.52 OVA hotfix 1084, Service Alert 1054
*EMC Unisphere for VMAX Virtual Appliance 184.108.40.206 ISO upgrade hotfix 1083, Service Alert 1053
*EMC Solutions Enabler Virtual Appliance 220.127.116.11 OVA hotfix 2051, Service Alert 1884
*EMC Solutions Enabler Virtual Appliance 18.104.22.168 ISO upgrade hotfix 2050, Service Alert 1883
*EMC Solutions Enabler Virtual Appliance 22.214.171.124 OVA hotfix 2049, Service Alert 1882
*EMC Solutions Enabler Virtual Appliance 126.96.36.199 ISO upgrade hotfix 2048, Service Alert 1881
*EMC VASA Virtual Appliance 188.8.131.522 OVA
*EMC VASA Virtual Appliance 184.108.40.2062 ISO upgrade
*eMGMT 220.127.116.110 ePack kit 6684
*eMGMT 18.104.22.1682 ePack kit 6700
EMC recommends all customers upgrade at the earliest opportunity.
Link to remedies:
Customers can download software for EMC Unisphere for VMAX Virtual Appliance 22.214.171.124 OVA and ISO from EMC Online
Support at https://support.emc.com/downloads/27045_Unisphere-for-VMAX
Customers are recommended to contact Customer Support and place a Customer Service Request for all other fixes.
EMC would like to thank rgod working with Trend Micro's Zero Day Initiative, for reporting this issue.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to email@example.com
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: firstname.lastname@example.org
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----