CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8012 – Dell EMC VNX Monitoring and Reporting RMI Registry Deserialization of Untrusted Data Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2017-8012
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Java Management Extensions (JMX) protocol used to communicate between components in the Alerting and/or Compliance components can be leveraged to create a denial of service (DoS) condition. Attackers with knowledge of JMX agent user credentials could potentially exploit this vulnerability to create arbitrary files on the affected system and create a DoS condition by leveraging inherent JMX protocol capabilities. En EMC ViPR SRM, Storage MR, VNX MR y MR (Watch4Net) para SAS Solution Packs, el protocolo Java Management Extensions (JMX) empleado para la comunicación entre componentes los componentes Alerting o Compliance puede aprovecharse para provocar una condición de denegación de servicio. Los atacantes que conozcan las credenciales de usuario del agente JMX podrían explotar esta vulnerabilidad para crear archivos arbitrarios en el sistema afectado y crear una condición de denegación de servicio mediante el aprovechamiento de las capacidades inherentes del protocolo JMX. This vulnerability allows remote attackers to create a denial of service on vulnerable installations of Dell EMC VNX Monitoring and Reporting. • http://seclists.org/fulldisclosure/2017/Sep/51 http://www.securityfocus.com/bid/100982 http://www.securitytracker.com/id/1039417 http://www.securitytracker.com/id/1039418 •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8007 – Dell EMC VNX Monitoring and Reporting Scheduler Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8007
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, and modify or delete data, by supplying specially crafted strings in input parameters of the web service call. En EMC ViPR SRM, Storage MR, VNX MR y MR (Watch4Net) para SAS Solution Packs, la puerta de enlace del servicio web se ha visto afectado por una vulnerabilidad de salto de directorio. Los atacantes que conozcan las credenciales de la puerta de enlace del servicio web podrían explotar esta vulnerabilidad para acceder a información no autorizada y modificar o borrar datos proporcionando strings especialmente manipuladas en parámetros de entrada de la llamada del servicio web. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell EMC VNX Monitoring and Reporting. • http://seclists.org/fulldisclosure/2017/Sep/51 http://www.securityfocus.com/bid/100957 http://www.securitytracker.com/id/1039417 http://www.securitytracker.com/id/1039418 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 1%CPEs: 4EXPL: 0CVE-2017-8011 – Dell EMC VNX Monitoring and Reporting Scheduler Static Credentials Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8011
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system. EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R para SAS Solution Packs (EMC ViPR SRM anterior a versión 4.1, EMC Storage M&R anterior a versión 4.1, EMC VNX M&R todas las versiones, EMC M&R (Watch4Net) para todas las versiones de SAS Solution Packs), contienen cuentas no documentadas con contraseñas por defecto para los componentes WebService Gateway y RMI JMX. Un atacante remoto con conocimiento de la contraseña por defecto puede usar estas cuentas para ejecutar servicios web arbitrarios y llamadas a procedimientos remotos sobre el sistema afectado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell EMC VNX Monitoring and Reporting. • http://seclists.org/fulldisclosure/2017/Jul/21 http://www.securityfocus.com/bid/99555 http://www.securitytracker.com/id/1038905 • CWE-798: Use of Hard-coded Credentials •