Sign-up

ID

VAR-201706-0322


CVE

CVE-2017-4987


TITLE

EMC VNX2 and VNX1 Target of VNX Control Station Vulnerability in arbitrary code execution on the system

Trust: 0.8

sources: JVNDB: JVNDB-2017-005011

DESCRIPTION

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user can load a maliciously crafted file in the search path which may potentially allow the attacker to execute arbitrary code on the targeted VNX Control Station system, aka an uncontrolled search path vulnerability. EMC VNX2 and VNX1 The target VNX Control Station A vulnerability exists that allows arbitrary code to be executed on the system. Versions prior to VNX2 OE for File 8.1.9.211 and VNX1 OE for File 7.1.80.8 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ESA-2017-041: EMC VNX1 and VNX2 Family Multiple Vulnerabilities in VNX Control Station EMC Identifier: ESA-2017-041 CVE Identifier: CVE-2017-4984, CVE-2017-4985, CVE-2017-4987 Severity Rating: CVSS v3 Base Score: See below for individual CVEs. Details: Remote code execution vulnerability (CVE-2017-4984) An unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. CVSS v3 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Local privilege escalation vulnerability (CVE-2017-4985) A local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. CVSS v3 Base Score: 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Resolution: The following releases contains resolutions to these vulnerabilities EMC VNX2 OE for File 8.1.9.211 EMC VNX1 OE for File 7.1.80.8 EMC recommends all customers upgrade at the earliest opportunity. Link to remedies: To upgrade your EMC VNX system contact EMC VNX Customer Support: https://support.emc.com Registered EMC Support customers can download EMC VNX software from the EMC Online Support web site at https://support.emc.com. [The following is standard text included in all security advisories. Please do not change or delete.] Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJZP+8EAAoJEHbcu+fsE81ZcQAIAKQy3Bz6TVxivhhkTu/JyasN NRL0ZGplMm8gy8nCQyu+8VuiWz/OKIyvc1HClt+cD4LcjbIH04jxx5/3TU7FtI2X RjOcngSq40lWWcmlJ4m8E1AejLiS26+bx35wFxR9jU75htfKlrb7VHXn8XjBDieb q8csQkdHS11oOXhxrzqkwmPJ9y1qvFd01ikAsNk92iJwiiK9eaGW8ZS5NpLVd0Tm DWgmZzz1mACdfS0gl/13QiBKgyB3S6QkaaWzDTwAr/kBx8EZwXNDb8YqjVLYt5Q3 zUhZILy57Tje9cC3rZyFxFAhYdAZtjSjoJ+Tp8fqhLQOjqcBuQ3PPw2kgHYiI/M= =9F5r -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2017-4987 // JVNDB: JVNDB-2017-005011 // BID: 99045 // VULHUB: VHN-113190 // PACKETSTORM: 142981

AFFECTED PRODUCTS

vendor:emcmodel:vnx1scope:eqversion: -

Trust: 1.6

vendor:emcmodel:vnx2scope:eqversion: -

Trust: 1.6

vendor:dell emc old emcmodel:vnx1scope:ltversion:oe for file 7.1.80.8

Trust: 0.8

vendor:dell emc old emcmodel:vnx2scope:ltversion:oe for file 8.1.9.211

Trust: 0.8

vendor:emcmodel:vnx2 oe for filescope:eqversion:8.1.9.155

Trust: 0.3

vendor:emcmodel:vnx1 oe for filescope:eqversion:7.1.79.6

Trust: 0.3

vendor:emcmodel:vnx2 oe for filescope:neversion:8.1.9.211

Trust: 0.3

vendor:emcmodel:vnx1 oe for filescope:neversion:7.1.80.8

Trust: 0.3

sources: BID: 99045 // JVNDB: JVNDB-2017-005011 // CNNVD: CNNVD-201706-813 // NVD: CVE-2017-4987

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-4987
value: HIGH

Trust: 1.0

NVD: CVE-2017-4987
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201706-813
value: MEDIUM

Trust: 0.6

VULHUB: VHN-113190
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-4987
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-113190
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-4987
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-113190 // JVNDB: JVNDB-2017-005011 // CNNVD: CNNVD-201706-813 // NVD: CVE-2017-4987

PROBLEMTYPE DATA

problemtype:CWE-427

Trust: 1.9

sources: VULHUB: VHN-113190 // JVNDB: JVNDB-2017-005011 // NVD: CVE-2017-4987

THREAT TYPE

local

Trust: 0.9

sources: BID: 99045 // CNNVD: CNNVD-201706-813

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201706-813

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-005011

PATCH
title:EMC VNXファミリーurl:https://www.dellemc.com/ja-jp/storage/vnx.htm
Trust: 0.8
title:EMC VNX2 OE for File  and VNX1 OE for File Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71258
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-005011 // 
            
            
            
            CNNVD: CNNVD-201706-813

EXTERNAL IDS
db:NVDid:CVE-2017-4987
Trust: 2.9
db:BIDid:99045
Trust: 1.4
db:JVNDBid:JVNDB-2017-005011
Trust: 0.8
db:CNNVDid:CNNVD-201706-813
Trust: 0.7
db:VULHUBid:VHN-113190
Trust: 0.1
db:PACKETSTORMid:142981
Trust: 0.1
sources:
            
            
            VULHUB: VHN-113190 // 
            
            
            
            BID: 99045 // 
            
            
            
            JVNDB: JVNDB-2017-005011 // 
            
            
            
            PACKETSTORM: 142981 // 
            
            
            
            CNNVD: CNNVD-201706-813 // 
            
            
            
            NVD: CVE-2017-4987

REFERENCES
url:http://www.securityfocus.com/archive/1/540738/30/0/threaded
Trust: 2.5
url:http://www.securityfocus.com/bid/99045
Trust: 1.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-4987
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-4987
Trust: 0.8
url:http://www.emc.com/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-4984
Trust: 0.1
url:https://support.emc.com
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-4985
Trust: 0.1
url:https://support.emc.com.
Trust: 0.1
sources:
            
            
            VULHUB: VHN-113190 // 
            
            
            
            BID: 99045 // 
            
            
            
            JVNDB: JVNDB-2017-005011 // 
            
            
            
            PACKETSTORM: 142981 // 
            
            
            
            CNNVD: CNNVD-201706-813 // 
            
            
            
            NVD: CVE-2017-4987

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 99045

SOURCES
db:VULHUBid:VHN-113190
db:BIDid:99045
db:JVNDBid:JVNDB-2017-005011
db:PACKETSTORMid:142981
db:CNNVDid:CNNVD-201706-813
db:NVDid:CVE-2017-4987

LAST UPDATE DATE
2025-04-20T23:26:04.833000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-113190date:2017-06-29T00:00:00
db:BIDid:99045date:2017-06-13T00:00:00
db:JVNDBid:JVNDB-2017-005011date:2017-07-12T00:00:00
db:CNNVDid:CNNVD-201706-813date:2017-06-29T00:00:00
db:NVDid:CVE-2017-4987date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-113190date:2017-06-19T00:00:00
db:BIDid:99045date:2017-06-13T00:00:00
db:JVNDBid:JVNDB-2017-005011date:2017-07-12T00:00:00
db:PACKETSTORMid:142981date:2017-06-16T17:32:22
db:CNNVDid:CNNVD-201706-813date:2017-06-29T00:00:00
db:NVDid:CVE-2017-4987date:2017-06-19T12:29:00.323