CVE-2018-1203 – Dell EMC Isilon OneFS - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2018-1203

In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, the tcpdump binary, being run with sudo, may potentially be used by compadmin to execute arbitrary code with root privileges. En Dell EMC Isilon OneFS, el usuario compadmin puede ejecutar el binario tcpdump con privilegios root. En versiones entre la 8.1.0.0 y la 8.1.0.1, la 8.0.1.0 y la 8.0.1.2 y entre la 8.0.0.0 y la 8.0.0.6, el binario tcpdump, ejecutado con sudo, podría ser utilizado por el usuario compadmin para ejecutar código arbitrario con privilegios root. Dell EMC Isilon OneFS suffers from code execution, cross site request forgery, and cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/44039 http://seclists.org/fulldisclosure/2018/Mar/50 http://www.securityfocus.com/bid/103033 https://www.coresecurity.com/advisories/dell-emc-isilon-onefs-multiple-vulnerabilities • CWE-732: Incorrect Permission Assignment for Critical Resource •