Sign-up

ID

VAR-201706-0319


CVE

CVE-2017-4984


TITLE

EMC VNX2 and VNX1 Authority in root Vulnerability promoted to

Trust: 0.8

sources: JVNDB: JVNDB-2017-005009

DESCRIPTION

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. This may potentially be exploited by an attacker to run arbitrary code with root-level privileges on the targeted VNX Control Station system, aka remote code execution. root May be promoted to. EMC VNX1/VNX2 OE for File are prone to a remote code-execution vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ESA-2017-041: EMC VNX1 and VNX2 Family Multiple Vulnerabilities in VNX Control Station EMC Identifier: ESA-2017-041 CVE Identifier: CVE-2017-4984, CVE-2017-4985, CVE-2017-4987 Severity Rating: CVSS v3 Base Score: See below for individual CVEs. CVSS v3 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Local privilege escalation vulnerability (CVE-2017-4985) A local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. Link to remedies: To upgrade your EMC VNX system contact EMC VNX Customer Support: https://support.emc.com Registered EMC Support customers can download EMC VNX software from the EMC Online Support web site at https://support.emc.com. [The following is standard text included in all security advisories. Please do not change or delete.] Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJZP+8EAAoJEHbcu+fsE81ZcQAIAKQy3Bz6TVxivhhkTu/JyasN NRL0ZGplMm8gy8nCQyu+8VuiWz/OKIyvc1HClt+cD4LcjbIH04jxx5/3TU7FtI2X RjOcngSq40lWWcmlJ4m8E1AejLiS26+bx35wFxR9jU75htfKlrb7VHXn8XjBDieb q8csQkdHS11oOXhxrzqkwmPJ9y1qvFd01ikAsNk92iJwiiK9eaGW8ZS5NpLVd0Tm DWgmZzz1mACdfS0gl/13QiBKgyB3S6QkaaWzDTwAr/kBx8EZwXNDb8YqjVLYt5Q3 zUhZILy57Tje9cC3rZyFxFAhYdAZtjSjoJ+Tp8fqhLQOjqcBuQ3PPw2kgHYiI/M= =9F5r -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2017-4984 // JVNDB: JVNDB-2017-005009 // BID: 99039 // VULHUB: VHN-113187 // VULMON: CVE-2017-4984 // PACKETSTORM: 142981

AFFECTED PRODUCTS

vendor:emcmodel:vnx1scope:eqversion: -

Trust: 1.6

vendor:emcmodel:vnx2scope:eqversion: -

Trust: 1.6

vendor:dell emc old emcmodel:vnx1scope:ltversion:oe for file 7.1.80.8

Trust: 0.8

vendor:dell emc old emcmodel:vnx2scope:ltversion:oe for file 8.1.9.211

Trust: 0.8

vendor:emcmodel:vnx2 oe for filescope:eqversion:8.1.9.155

Trust: 0.3

vendor:emcmodel:vnx1 oe for filescope:eqversion:7.1.79.6

Trust: 0.3

vendor:emcmodel:vnx2 oe for filescope:neversion:8.1.9.211

Trust: 0.3

vendor:emcmodel:vnx1 oe for filescope:neversion:7.1.80.8

Trust: 0.3

sources: BID: 99039 // JVNDB: JVNDB-2017-005009 // CNNVD: CNNVD-201706-815 // NVD: CVE-2017-4984

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-4984
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-4984
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201706-815
value: CRITICAL

Trust: 0.6

VULHUB: VHN-113187
value: HIGH

Trust: 0.1

VULMON: CVE-2017-4984
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-4984
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-113187
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-4984
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-113187 // VULMON: CVE-2017-4984 // JVNDB: JVNDB-2017-005009 // CNNVD: CNNVD-201706-815 // NVD: CVE-2017-4984

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.9

sources: VULHUB: VHN-113187 // JVNDB: JVNDB-2017-005009 // NVD: CVE-2017-4984

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201706-815

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201706-815

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-005009

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-113187

PATCH
title:EMC VNXファミリーurl:https://www.dellemc.com/ja-jp/storage/vnx.htm
Trust: 0.8
title:EMC VNX2 OE for File  and VNX1 OE for File Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71260
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-005009 // 
            
            
            
            CNNVD: CNNVD-201706-815

EXTERNAL IDS
db:NVDid:CVE-2017-4984
Trust: 3.0
db:BIDid:99039
Trust: 1.5
db:JVNDBid:JVNDB-2017-005009
Trust: 0.8
db:CNNVDid:CNNVD-201706-815
Trust: 0.7
db:PACKETSTORMid:142981
Trust: 0.2
db:VULHUBid:VHN-113187
Trust: 0.1
db:VULMONid:CVE-2017-4984
Trust: 0.1
sources:
            
            
            VULHUB: VHN-113187 // 
            
            
            
            VULMON: CVE-2017-4984 // 
            
            
            
            BID: 99039 // 
            
            
            
            JVNDB: JVNDB-2017-005009 // 
            
            
            
            PACKETSTORM: 142981 // 
            
            
            
            CNNVD: CNNVD-201706-815 // 
            
            
            
            NVD: CVE-2017-4984

REFERENCES
url:http://www.securityfocus.com/archive/1/540738/30/0/threaded
Trust: 2.6
url:http://www.securityfocus.com/bid/99039
Trust: 1.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-4984
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-4984
Trust: 0.8
url:http://www.emc.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/77.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://support.emc.com
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-4987
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-4985
Trust: 0.1
url:https://support.emc.com.
Trust: 0.1
sources:
            
            
            VULHUB: VHN-113187 // 
            
            
            
            VULMON: CVE-2017-4984 // 
            
            
            
            BID: 99039 // 
            
            
            
            JVNDB: JVNDB-2017-005009 // 
            
            
            
            PACKETSTORM: 142981 // 
            
            
            
            CNNVD: CNNVD-201706-815 // 
            
            
            
            NVD: CVE-2017-4984

CREDITS
EMC
Trust: 0.3
sources:
            
            
            BID: 99039

SOURCES
db:VULHUBid:VHN-113187
db:VULMONid:CVE-2017-4984
db:BIDid:99039
db:JVNDBid:JVNDB-2017-005009
db:PACKETSTORMid:142981
db:CNNVDid:CNNVD-201706-815
db:NVDid:CVE-2017-4984

LAST UPDATE DATE
2025-04-20T23:26:04.797000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-113187date:2017-06-29T00:00:00
db:VULMONid:CVE-2017-4984date:2017-06-29T00:00:00
db:BIDid:99039date:2017-06-13T00:00:00
db:JVNDBid:JVNDB-2017-005009date:2017-07-12T00:00:00
db:CNNVDid:CNNVD-201706-815date:2017-06-29T00:00:00
db:NVDid:CVE-2017-4984date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-113187date:2017-06-19T00:00:00
db:VULMONid:CVE-2017-4984date:2017-06-19T00:00:00
db:BIDid:99039date:2017-06-13T00:00:00
db:JVNDBid:JVNDB-2017-005009date:2017-07-12T00:00:00
db:PACKETSTORMid:142981date:2017-06-16T17:32:22
db:CNNVDid:CNNVD-201706-815date:2017-06-29T00:00:00
db:NVDid:CVE-2017-4984date:2017-06-19T12:29:00.230