Lucene search

DellCVE-2017-4985

HistoryJun 19, 2017 - 12:29 p.m.

CVE-2017-4985

2017-06-1912:29:00

CWE-862

dell

web.nvd.nist.gov

cve-2017-4985

emc

vnx2

vnx1

privilege escalaton

authorization checks

perl scripts

arbitrary commands

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attacker to run arbitrary commands as root on the targeted VNX Control Station system.

Affected configurations

Nvd

Node

emcvnx2_firmwareMatch-

AND

emcvnx2Match-

Node

emcvnx1_firmwareMatch-

AND

emcvnx1Match-

VendorProductVersionCPE
emcvnx2_firmware-cpe:2.3:o:emc:vnx2_firmware:-:*:*:*:*:*:*:*
emcvnx2-cpe:2.3:h:emc:vnx2:-:*:*:*:*:*:*:*
emcvnx1_firmware-cpe:2.3:o:emc:vnx1_firmware:-:*:*:*:*:*:*:*
emcvnx1-cpe:2.3:h:emc:vnx1:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emc	vnx2_firmware	-	cpe:2.3:o:emc:vnx2_firmware:-:::::::*
emc	vnx2	-	cpe:2.3:h:emc:vnx2:-:::::::*
emc	vnx1_firmware	-	cpe:2.3:o:emc:vnx1_firmware:-:::::::*
emc	vnx1	-	cpe:2.3:h:emc:vnx1:-:::::::*

CNA Affected

[
  {
    "product": "EMC VNX2 versions prior to OE for File 8.1.9.211, EMC VNX1 versions prior to OE for File 7.1.80.8",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EMC VNX2 versions prior to OE for File 8.1.9.211, EMC VNX1 versions prior to OE for File 7.1.80.8"
      }
    ]
  }
]

References

www.securityfocus.com/archive/1/540738/30/0/threaded

www.securityfocus.com/bid/99037

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2017-4985