Sign-up

ID

VAR-201207-0336


CVE

CVE-2012-2282


TITLE

EMC Celerra Network Server , EMC VNX ,and EMC VNXe Vulnerable to reading files

Trust: 0.8

sources: JVNDB: JVNDB-2012-003108

DESCRIPTION

EMC Celerra Network Server 6.x before 6.0.61.0, VNX 7.x before 7.0.53.2, and VNXe 2.0 and 2.1 before 2.1.3.19077 (aka MR1 SP3.2) and 2.2 before 2.2.0.19078 (aka MR2 SP0.2) do not properly implement NFS access control, which allows remote authenticated users to read or modify files via a (1) NFSv2, (2) NFSv3, or (3) NFSv4 request. There are security vulnerabilities in multiple EMC products. Failure to properly access control settings allows an attacker to exploit the vulnerability to bypass security restrictions and gain unauthorized access to the output file system. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-027: EMC Celerra/VNX/VNXe Improper Access Control Vulnerability EMC Identifier: ESA-2012-027 CVE Identifier: CVE-2012-2282 Severity Rating: CVSS v2 Base Score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C) Affected products: EMC Celerra Network Server versions 6.0.36.4 through 6.0.60.2 EMC VNX versions 7.0.12.0 through 7.0.53.1 EMC VNXe 2.0 (including SP1, SP2, and SP3) EMC VNXe MR1 (including SP1, SP2, SP3, and SP3.1) EMC VNXe MR2 (including SP0.1) Vulnerability Summary: A vulnerability exists in EMC Celerra/VNX/VNXe systems that can be potentially exploited to gain unauthorized access to distributed files and directories. For EMC Celerra, navigate in Powerlink to Home > Support > Software Downloads and Licensing > Downloads C > Celerra Software For EMC VNX, navigate in Powerlink to Home >Support>Support by Product and search for VNX For EMC VNXe, Log onto the affected VNXe, navigate in Support Zone as follows: Settings > More Configuration > Update Software > Obtain Candidate Version Online Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. EMC Product Security Response Center Security_Alert@emc.com http://www.emc.com/contact-us/contact/product-security-response-center.htm -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (Cygwin) iEYEARECAAYFAk/9nQcACgkQtjd2rKp+ALwy+QCfRYR3eaF29k28f7gYjgC0vcVk NLIAn0GWWLPQ0VPfcFUjC6RlyahlwImL =wjkz -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- We are millions! Join us to protect all Pc's Worldwide. Download the new Secunia PSI 3.0 available in 5 languages and share it with your friends: http://secunia.com/psi ---------------------------------------------------------------------- TITLE: EMC Products Security Bypass Security Issue SECUNIA ADVISORY ID: SA49911 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/49911/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=49911 RELEASE DATE: 2012-07-12 DISCUSS ADVISORY: http://secunia.com/advisories/49911/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/49911/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=49911 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A security issue has been reported in multiple EMC products, which can be exploited by malicious users to potentially bypass certain security restrictions. SOLUTION: Update to a fixed version. Updated software can be downloaded from Powerlink. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: EMC (ESA-2012-027): http://archives.neohapsis.com/archives/bugtraq/2012-07/att-0063/ESA-2012-027.txt OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.61

sources: NVD: CVE-2012-2282 // JVNDB: JVNDB-2012-003108 // CNVD: CNVD-2012-3692 // BID: 54414 // PACKETSTORM: 114647 // PACKETSTORM: 114653

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2012-3692

AFFECTED PRODUCTS

vendor:emcmodel:vnxescope:eqversion:mr2

Trust: 1.6

vendor:emcmodel:vnxescope:eqversion:mr1

Trust: 1.6

vendor:emcmodel:vnxscope:eqversion:7.0.53.1

Trust: 1.6

vendor:emcmodel:vnxescope:eqversion:2.0

Trust: 1.6

vendor:emcmodel:celerra network serverscope:eqversion:6.0.36.4

Trust: 1.0

vendor:emcmodel:celerra network serverscope:eqversion:6.0.60.2

Trust: 1.0

vendor:emcmodel:vnxscope:eqversion:7.0.12.0

Trust: 1.0

vendor:dell emc old emcmodel:vnxscope:ltversion:7.x

Trust: 0.8

vendor:dell emc old emcmodel:vnxescope:eqversion:2.1.3.19077

Trust: 0.8

vendor:dell emc old emcmodel:celerra network serverscope:eqversion:6.0.61.0

Trust: 0.8

vendor:dell emc old emcmodel:vnxescope:eqversion:2.0

Trust: 0.8

vendor:dell emc old emcmodel:vnxescope:ltversion:2.1

Trust: 0.8

vendor:dell emc old emcmodel:vnxscope:eqversion:7.0.53.2

Trust: 0.8

vendor:dell emc old emcmodel:celerra network serverscope:ltversion:6.x

Trust: 0.8

vendor:dell emc old emcmodel:vnxescope:eqversion:2.2.0.19078

Trust: 0.8

vendor:dell emc old emcmodel:vnxescope:ltversion:2.2

Trust: 0.8

vendor:emcmodel:celerra network serverscope:eqversion:6.x

Trust: 0.6

vendor:emcmodel:vnx operating environment for filescope:eqversion:7.x

Trust: 0.6

vendor:emcmodel:vnxescope:eqversion:2.x

Trust: 0.6

sources: CNVD: CNVD-2012-3692 // JVNDB: JVNDB-2012-003108 // CNNVD: CNNVD-201207-162 // NVD: CVE-2012-2282

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-2282
value: MEDIUM

Trust: 1.0

NVD: CVE-2012-2282
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201207-162
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2012-2282
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2012-003108 // CNNVD: CNNVD-201207-162 // NVD: CVE-2012-2282

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.8

sources: JVNDB: JVNDB-2012-003108 // NVD: CVE-2012-2282

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201207-162

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201207-162

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-003108

PATCH
title:NVX ファミリurl:http://japan.emc.com/storage/vnx/vnx-family.htm
Trust: 0.8
title:Top Pageurl:http://www.emc.com/index.htm
Trust: 0.8
title:EMC multiple product security bypass vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/18836
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-3692 // 
            
            
            
            JVNDB: JVNDB-2012-003108

EXTERNAL IDS
db:NVDid:CVE-2012-2282
Trust: 3.4
db:SECTRACKid:1027242
Trust: 1.0
db:JVNDBid:JVNDB-2012-003108
Trust: 0.8
db:SECUNIAid:49911
Trust: 0.7
db:CNVDid:CNVD-2012-3692
Trust: 0.6
db:NSFOCUSid:19996
Trust: 0.6
db:BUGTRAQid:20120711 ESA-2012-027: EMC CELERRA/VNX/VNXE IMPROPER ACCESS CONTROL VULNERABILITY
Trust: 0.6
db:CNNVDid:CNNVD-201207-162
Trust: 0.6
db:BIDid:54414
Trust: 0.3
db:PACKETSTORMid:114647
Trust: 0.1
db:PACKETSTORMid:114653
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-3692 // 
            
            
            
            BID: 54414 // 
            
            
            
            JVNDB: JVNDB-2012-003108 // 
            
            
            
            PACKETSTORM: 114647 // 
            
            
            
            PACKETSTORM: 114653 // 
            
            
            
            CNNVD: CNNVD-201207-162 // 
            
            
            
            NVD: CVE-2012-2282

REFERENCES
url:http://archives.neohapsis.com/archives/bugtraq/2012-07/0063.html
Trust: 1.6
url:http://www.securitytracker.com/id?1027242
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2282
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2282
Trust: 0.8
url:http://archives.neohapsis.com/archives/bugtraq/2012-07/att-0063/esa-2012-027.txt
Trust: 0.7
url:http://secunia.com/advisories/49911
Trust: 0.6
url:http://www.nsfocus.net/vulndb/19996
Trust: 0.6
url:http://www.emc.com/?fromglobalsiteselect
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2012-2282
Trust: 0.1
url:http://www.emc.com/contact-us/contact/product-security-response-center.htm
Trust: 0.1
url:http://secunia.com/advisories/49911/
Trust: 0.1
url:http://secunia.com/psi
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=49911
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/49911/#comments
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-3692 // 
            
            
            
            BID: 54414 // 
            
            
            
            JVNDB: JVNDB-2012-003108 // 
            
            
            
            PACKETSTORM: 114647 // 
            
            
            
            PACKETSTORM: 114653 // 
            
            
            
            CNNVD: CNNVD-201207-162 // 
            
            
            
            NVD: CVE-2012-2282

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 54414

SOURCES
db:CNVDid:CNVD-2012-3692
db:BIDid:54414
db:JVNDBid:JVNDB-2012-003108
db:PACKETSTORMid:114647
db:PACKETSTORMid:114653
db:CNNVDid:CNNVD-201207-162
db:NVDid:CVE-2012-2282

LAST UPDATE DATE
2025-04-11T22:59:17.182000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-3692date:2012-07-17T00:00:00
db:BIDid:54414date:2013-04-02T13:07:00
db:JVNDBid:JVNDB-2012-003108date:2012-07-18T00:00:00
db:CNNVDid:CNNVD-201207-162date:2012-07-16T00:00:00
db:NVDid:CVE-2012-2282date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2012-3692date:2012-07-17T00:00:00
db:BIDid:54414date:2012-07-12T00:00:00
db:JVNDBid:JVNDB-2012-003108date:2012-07-18T00:00:00
db:PACKETSTORMid:114647date:2012-07-12T02:05:18
db:PACKETSTORMid:114653date:2012-07-12T06:05:32
db:CNNVDid:CNNVD-201207-162date:2012-07-16T00:00:00
db:NVDid:CVE-2012-2282date:2012-07-16T20:55:00.830