Sign-up

ID

VAR-201706-0320


CVE

CVE-2017-4985


TITLE

EMC VNX2 and VNX1 Authority in root Vulnerability promoted to

Trust: 0.8

sources: JVNDB: JVNDB-2017-005010

DESCRIPTION

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attacker to run arbitrary commands as root on the targeted VNX Control Station system. EMC VNX1/VNX2 OE for File are prone to a local privilege-escalation vulnerability. The vulnerability stems from the fact that the program does not perform authentication. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ESA-2017-041: EMC VNX1 and VNX2 Family Multiple Vulnerabilities in VNX Control Station EMC Identifier: ESA-2017-041 CVE Identifier: CVE-2017-4984, CVE-2017-4985, CVE-2017-4987 Severity Rating: CVSS v3 Base Score: See below for individual CVEs. Details: Remote code execution vulnerability (CVE-2017-4984) An unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Uncontrolled search path vulnerability (CVE-2017-4987) This vulnerability may be exploited by a local authenticated user to load a maliciously crafted file in the search path which may potentially allow the attacker to execute arbitrary code on the targeted VNX Control Station system. Link to remedies: To upgrade your EMC VNX system contact EMC VNX Customer Support: https://support.emc.com Registered EMC Support customers can download EMC VNX software from the EMC Online Support web site at https://support.emc.com. [The following is standard text included in all security advisories. Please do not change or delete.] Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJZP+8EAAoJEHbcu+fsE81ZcQAIAKQy3Bz6TVxivhhkTu/JyasN NRL0ZGplMm8gy8nCQyu+8VuiWz/OKIyvc1HClt+cD4LcjbIH04jxx5/3TU7FtI2X RjOcngSq40lWWcmlJ4m8E1AejLiS26+bx35wFxR9jU75htfKlrb7VHXn8XjBDieb q8csQkdHS11oOXhxrzqkwmPJ9y1qvFd01ikAsNk92iJwiiK9eaGW8ZS5NpLVd0Tm DWgmZzz1mACdfS0gl/13QiBKgyB3S6QkaaWzDTwAr/kBx8EZwXNDb8YqjVLYt5Q3 zUhZILy57Tje9cC3rZyFxFAhYdAZtjSjoJ+Tp8fqhLQOjqcBuQ3PPw2kgHYiI/M= =9F5r -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2017-4985 // JVNDB: JVNDB-2017-005010 // BID: 99037 // VULHUB: VHN-113188 // PACKETSTORM: 142981

AFFECTED PRODUCTS

vendor:emcmodel:vnx1scope:eqversion: -

Trust: 1.6

vendor:emcmodel:vnx2scope:eqversion: -

Trust: 1.6

vendor:dell emc old emcmodel:vnx1scope:ltversion:oe for file 7.1.80.8

Trust: 0.8

vendor:dell emc old emcmodel:vnx2scope:ltversion:oe for file 8.1.9.211

Trust: 0.8

vendor:emcmodel:vnx2 oe for filescope:eqversion:8.1.9.155

Trust: 0.3

vendor:emcmodel:vnx1 oe for filescope:eqversion:7.1.79.6

Trust: 0.3

vendor:emcmodel:vnx2 oe for filescope:neversion:8.1.9.211

Trust: 0.3

vendor:emcmodel:vnx1 oe for filescope:neversion:7.1.80.8

Trust: 0.3

sources: BID: 99037 // JVNDB: JVNDB-2017-005010 // CNNVD: CNNVD-201706-814 // NVD: CVE-2017-4985

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-4985
value: HIGH

Trust: 1.0

NVD: CVE-2017-4985
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201706-814
value: HIGH

Trust: 0.6

VULHUB: VHN-113188
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-4985
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-113188
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-4985
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-113188 // JVNDB: JVNDB-2017-005010 // CNNVD: CNNVD-201706-814 // NVD: CVE-2017-4985

PROBLEMTYPE DATA

problemtype:CWE-862

Trust: 1.1

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-113188 // JVNDB: JVNDB-2017-005010 // NVD: CVE-2017-4985

THREAT TYPE

local

Trust: 0.9

sources: BID: 99037 // CNNVD: CNNVD-201706-814

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201706-814

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-005010

PATCH
title:EMC VNXファミリーurl:https://www.dellemc.com/ja-jp/storage/vnx.htm
Trust: 0.8
title:EMC VNX2 OE for File  and VNX1 OE for File Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71259
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-005010 // 
            
            
            
            CNNVD: CNNVD-201706-814

EXTERNAL IDS
db:NVDid:CVE-2017-4985
Trust: 2.9
db:BIDid:99037
Trust: 2.0
db:JVNDBid:JVNDB-2017-005010
Trust: 0.8
db:CNNVDid:CNNVD-201706-814
Trust: 0.7
db:VULHUBid:VHN-113188
Trust: 0.1
db:PACKETSTORMid:142981
Trust: 0.1
sources:
            
            
            VULHUB: VHN-113188 // 
            
            
            
            BID: 99037 // 
            
            
            
            JVNDB: JVNDB-2017-005010 // 
            
            
            
            PACKETSTORM: 142981 // 
            
            
            
            CNNVD: CNNVD-201706-814 // 
            
            
            
            NVD: CVE-2017-4985

REFERENCES
url:http://www.securityfocus.com/archive/1/540738/30/0/threaded
Trust: 2.5
url:http://www.securityfocus.com/bid/99037
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2017-4985
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-4985
Trust: 0.8
url:http://www.emc.com/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-4984
Trust: 0.1
url:https://support.emc.com
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-4987
Trust: 0.1
url:https://support.emc.com.
Trust: 0.1
sources:
            
            
            VULHUB: VHN-113188 // 
            
            
            
            BID: 99037 // 
            
            
            
            JVNDB: JVNDB-2017-005010 // 
            
            
            
            PACKETSTORM: 142981 // 
            
            
            
            CNNVD: CNNVD-201706-814 // 
            
            
            
            NVD: CVE-2017-4985

CREDITS
EMC
Trust: 0.3
sources:
            
            
            BID: 99037

SOURCES
db:VULHUBid:VHN-113188
db:BIDid:99037
db:JVNDBid:JVNDB-2017-005010
db:PACKETSTORMid:142981
db:CNNVDid:CNNVD-201706-814
db:NVDid:CVE-2017-4985

LAST UPDATE DATE
2025-04-20T23:26:04.866000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-113188date:2019-10-03T00:00:00
db:BIDid:99037date:2017-06-13T00:00:00
db:JVNDBid:JVNDB-2017-005010date:2017-07-12T00:00:00
db:CNNVDid:CNNVD-201706-814date:2019-10-23T00:00:00
db:NVDid:CVE-2017-4985date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-113188date:2017-06-19T00:00:00
db:BIDid:99037date:2017-06-13T00:00:00
db:JVNDBid:JVNDB-2017-005010date:2017-07-12T00:00:00
db:PACKETSTORMid:142981date:2017-06-16T17:32:22
db:CNNVDid:CNNVD-201706-814date:2017-06-29T00:00:00
db:NVDid:CVE-2017-4985date:2017-06-19T12:29:00.293