[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability
From:       Security Alert <Security_Alert () emc ! com>
Date:       2013-12-19 19:10:15
Message-ID: 37F0BE0896DB1544B5BEFBE34F79D05330FF5616 () MX103CL01 ! corp ! emc ! com
[Download RAW message or body]

["ESA-2013-094.txt" (text/plain)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability

EMC Identifier: ESA-2013-094 

CVE Identifier:  CVE-2012-0874

Severity Rating: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


Affected products:  
•	All EMC Data Protection Advisor (DPA) versions of 5.x


Summary:  
EMC DPA may be vulnerable to remote code execution vulnerability.


Details: 
The DPA Illuminator service (DPA_Illuminator.exe) listening on port 8090 (tcp/http) \
and 8453 (tcp/https) embeds JBOSS servlets (JMXInvokerServlet and EJBInvokerServlet). \
These JBOSS servlets   are vulnerable to remote code execution vulnerability.  The \
vulnerability could be exploited to execute remote code with NT AUTHORITY\SYSTEM \
privileges. See http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0874 for \
more details. 

Affected JBOSS servlets are not required for DPA functionality. This vulnerability \
does not affect EMC DPA versions 6.x. 

 Follow the steps below to remove the vulnerable JBOSS servlets from DPA 5.x  system \
and mitigate the security risk.


Resolution:  
The following products contain the resolution to this issue:
•	EMC DPA version 6.x and later.

Workaround for DPA 5.x versions: 
1.	Stop the DPA Illuminator service.
2.	Open <Install dir>\Illuminator_Server\JBoss\server\illuminator\deploy. For \
example: C:\Program Files\EMC\DPA\Illuminator_Server\JBoss\server\illuminator\deploy \
3.	Delete http-invoker.sar directory. 4.	Start the DPA Illuminator service.

EMC strongly recommends all customers upgrade to version 6.x or higher or apply \
workaround for 5.x versions at the earliest opportunity.


Link to remedies:

Registered EMC Online Support customers can download patches and software from \
support.emc.com at: https://support.emc.com/downloads/829_Data-Protection-Advisor  
Credits: 
EMC would like to thank Andrea Micalizzi (aka rgod) for discovering this issue. 


Read and use the information in this EMC Security Advisory to assist in avoiding any \
situation that might arise from the problems described herein. If you have any \
questions regarding this product alert, contact EMC Software Technical Support at \
1-877-534-2867.

For an explanation of Severity Ratings, refer to EMC Knowledgebase solution \
emc218831. EMC recommends all customers take into account both the base score and any \
relevant temporal and environmental scores which may impact the potential severity \
associated with particular security vulnerability.

EMC Corporation distributes EMC Security Advisories, in order to bring to the \
attention of users of the affected EMC products, important security information. EMC \
recommends that all users determine the applicability of this information to their \
individual situations and take appropriate action. The information set forth herein \
is provided "as is" without warranty of any kind. EMC disclaims all warranties, \
either express or implied, including the warranties of merchantability, fitness for a \
particular purpose, title and non-infringement. In no event, shall EMC or its \
suppliers, be liable for any damages whatsoever including direct, indirect, \
incidental, consequential, loss of business profits or special damages, even if EMC \
or its suppliers have been advised of the possibility of such damages. Some states do \
not allow the exclusion or limitation of liability for consequential or incidental \
damages, so the foregoing limitation may not apply.



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Cygwin)

iEYEARECAAYFAlKzP2AACgkQtjd2rKp+ALxoNACgtBXByJQv59K6/7EynNjxA9DQ
tOwAoNl/PWIbRnLriOvbaIbcm/tICI5P
=Jq4q
-----END PGP SIGNATURE-----



[prev in list] [next in list] [prev in thread] [next in thread]