Sign-up

ID

VAR-201707-0990


CVE

CVE-2017-8011


TITLE

plural EMC Vulnerabilities related to the use of hard-coded credentials in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-006018

DESCRIPTION

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell EMC VNX Monitoring and Reporting. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.The specific flaw exists within the Scheduler class. An attacker can use the static credentials to access VNX Webservice Gateway service's API to execute arbitrary code under the context of SYSTEM. Multiple EMC Products are prone to an insecure default-password vulnerability. Remote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. Resolution: Customers are strongly advised to change any default passwords for Webservice Gateway and RMI JMX components. * EMC ViPR SRM and EMC Storage M&R customers should refer to the EMC M&R Platform 6.8 Security Configuration Guide (part of the EMC ViPR SRM 4.1 documentation, found at https://community.emc.com/docs/DOC-59221) for the procedure to modify default passwords * EMC M&R (Watch4Net) for SAS Solution Packs customers should refer to the knowledgebase article below for the procedure to modify default passwords: https://support.emc.com/kb/501588 * EMC VNX M&R customers should refer to the knowledgebase article below for the procedure to modify default passwords: https://support.emc.com/kb/501419 Link to remedies: Credits: EMC would like to thank rgod working with Trend Micro's Zero Day Initiative for reporting this vulnerability. [The following is standard text included in all security advisories. Please do not change or delete.] Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJZZSKkAAoJEHbcu+fsE81ZCHUH/0XvP8+rUcE7d4SljEpl8Ayd 3YMeSnak8CPcHAJq6xTWjDt8KnBlwwSaeAvBap0akxF/sqnnOOk7wLDBuc9kDt7y yp1DgiGgLOlVv5s8kAPCnJ0b7JkszrZ8mleJnqWBohKYUhlPeNTOj+x/NBmBoEWN fFvQ/deN2ArzRyz4XYDMbEfJFe2f8hSCg9YjZpdMi0nTRlRn6WRxgX5kwKjh2w6I tKakT0UGyOPv3VUaolDrCTegvt4BeBeQzeEZmlP0IEWeVmLLRgrpH4k8Dle9K+l5 BVDI2QFcg++CS5L1KPdZr+OVSOVUhdX6MtWlShAvZrxQ54zGf237fubsNJd6V6U= =iu/j -----END PGP SIGNATURE-----

Trust: 2.7

sources: NVD: CVE-2017-8011 // JVNDB: JVNDB-2017-006018 // ZDI: ZDI-17-505 // BID: 99555 // VULMON: CVE-2017-8011 // PACKETSTORM: 143341

AFFECTED PRODUCTS

vendor:dellmodel:emc storage monitoring and reportingscope:eqversion:4.0.2

Trust: 1.0

vendor:dellmodel:emc m\&rscope:eqversion: -

Trust: 1.0

vendor:dellmodel:emc vipr srmscope:lteversion:4.0.2

Trust: 1.0

vendor:dellmodel:emc vnx monitoring and reportingscope:eqversion: -

Trust: 1.0

vendor:dell emc old emcmodel:m&rscope:eqversion:(sas solution pack for )

Trust: 0.8

vendor:dell emc old emcmodel:storage m&rscope:ltversion:4.1

Trust: 0.8

vendor:dell emc old emcmodel:vnx m&rscope:eqversion: -

Trust: 0.8

vendor:dell emc old emcmodel:vipr srmscope:ltversion:4.1

Trust: 0.8

vendor:dell emcmodel:vnx monitoring and reportingscope: - version: -

Trust: 0.7

vendor:emcmodel:m\&rscope:eqversion: -

Trust: 0.6

vendor:emcmodel:vipr srmscope:eqversion:4.0.2

Trust: 0.6

vendor:emcmodel:vnx m\&rscope:eqversion: -

Trust: 0.6

vendor:emcmodel:storage m\&rscope:eqversion:4.0.2

Trust: 0.6

vendor:emcmodel:vipr srmscope:eqversion:4.0.1

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.6.3

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.6.4

Trust: 0.3

vendor:emcmodel:storage monitoring and reportingscope:eqversion:4.1

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:4.1

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.6.1

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.7.2

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.6.0

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.7.1

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.6.2

Trust: 0.3

vendor:emcmodel:vipr srmscope:eqversion:3.7

Trust: 0.3

vendor:emcmodel:storage monitoring and reportingscope:eqversion:4.0

Trust: 0.3

vendor:emcmodel:m&r for sas solution packsscope:eqversion:0

Trust: 0.3

vendor:emcmodel:vnx monitoring and reportingscope:eqversion:0

Trust: 0.3

sources: ZDI: ZDI-17-505 // BID: 99555 // JVNDB: JVNDB-2017-006018 // CNNVD: CNNVD-201707-600 // NVD: CVE-2017-8011

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-8011
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-8011
value: CRITICAL

Trust: 0.8

ZDI: CVE-2017-8011
value: HIGH

Trust: 0.7

CNNVD: CNNVD-201707-600
value: CRITICAL

Trust: 0.6

VULMON: CVE-2017-8011
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-8011
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

ZDI: CVE-2017-8011
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

nvd@nist.gov: CVE-2017-8011
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2017-8011
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: ZDI: ZDI-17-505 // VULMON: CVE-2017-8011 // JVNDB: JVNDB-2017-006018 // CNNVD: CNNVD-201707-600 // NVD: CVE-2017-8011

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.8

sources: JVNDB: JVNDB-2017-006018 // NVD: CVE-2017-8011

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 143341 // CNNVD: CNNVD-201707-600

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201707-600

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-006018

PATCH
title:Top Pageurl:https://japan.emc.com/about/index.htm
Trust: 0.8
title:Dell EMC has issued an update to correct this vulnerability.url:http://seclists.org/fulldisclosure/2017/Jul/21
Trust: 0.7
title:Multiple EMC Product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74802
Trust: 0.6
sources:
            
            
            ZDI: ZDI-17-505 // 
            
            
            
            JVNDB: JVNDB-2017-006018 // 
            
            
            
            CNNVD: CNNVD-201707-600

EXTERNAL IDS
db:NVDid:CVE-2017-8011
Trust: 3.6
db:BIDid:99555
Trust: 2.0
db:SECTRACKid:1038905
Trust: 1.7
db:JVNDBid:JVNDB-2017-006018
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-4768
Trust: 0.7
db:ZDIid:ZDI-17-505
Trust: 0.7
db:CNNVDid:CNNVD-201707-600
Trust: 0.6
db:VULMONid:CVE-2017-8011
Trust: 0.1
db:PACKETSTORMid:143341
Trust: 0.1
sources:
            
            
            ZDI: ZDI-17-505 // 
            
            
            
            VULMON: CVE-2017-8011 // 
            
            
            
            BID: 99555 // 
            
            
            
            JVNDB: JVNDB-2017-006018 // 
            
            
            
            PACKETSTORM: 143341 // 
            
            
            
            CNNVD: CNNVD-201707-600 // 
            
            
            
            NVD: CVE-2017-8011

REFERENCES
url:http://seclists.org/fulldisclosure/2017/jul/21
Trust: 3.5
url:http://www.securitytracker.com/id/1038905
Trust: 1.7
url:http://www.securityfocus.com/bid/99555
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2017-8011
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8011
Trust: 0.8
url:http://www.emc.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/798.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://community.emc.com/docs/doc-59221)
Trust: 0.1
url:https://support.emc.com/kb/501419
Trust: 0.1
url:https://support.emc.com/kb/501588
Trust: 0.1
sources:
            
            
            ZDI: ZDI-17-505 // 
            
            
            
            VULMON: CVE-2017-8011 // 
            
            
            
            BID: 99555 // 
            
            
            
            JVNDB: JVNDB-2017-006018 // 
            
            
            
            PACKETSTORM: 143341 // 
            
            
            
            CNNVD: CNNVD-201707-600 // 
            
            
            
            NVD: CVE-2017-8011

CREDITS
rgod
Trust: 1.7
sources:
            
            
            ZDI: ZDI-17-505 // 
            
            
            
            BID: 99555 // 
            
            
            
            PACKETSTORM: 143341 // 
            
            
            
            CNNVD: CNNVD-201707-600

SOURCES
db:ZDIid:ZDI-17-505
db:VULMONid:CVE-2017-8011
db:BIDid:99555
db:JVNDBid:JVNDB-2017-006018
db:PACKETSTORMid:143341
db:CNNVDid:CNNVD-201707-600
db:NVDid:CVE-2017-8011

LAST UPDATE DATE
2025-04-20T23:36:48.651000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-17-505date:2017-08-01T00:00:00
db:VULMONid:CVE-2017-8011date:2017-07-27T00:00:00
db:BIDid:99555date:2017-07-11T00:00:00
db:JVNDBid:JVNDB-2017-006018date:2017-08-15T00:00:00
db:CNNVDid:CNNVD-201707-600date:2021-09-01T00:00:00
db:NVDid:CVE-2017-8011date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:ZDIid:ZDI-17-505date:2017-08-01T00:00:00
db:VULMONid:CVE-2017-8011date:2017-07-17T00:00:00
db:BIDid:99555date:2017-07-11T00:00:00
db:JVNDBid:JVNDB-2017-006018date:2017-08-15T00:00:00
db:PACKETSTORMid:143341date:2017-07-12T23:19:06
db:CNNVDid:CNNVD-201707-600date:2017-07-11T00:00:00
db:NVDid:CVE-2017-8011date:2017-07-17T14:29:01.250