cnvd - cnvd-2015-07847

cnvd-2015-07847

Vulnerability from cnvd

Title: EMC Isilon OneFS操作系统权限提升漏洞

Description:

EMC Isilon OneFS Operating System是集文件系统、卷管理器及数据防护于一体的智能文件系统。

EMC Isilon OneFS操作系统7.1.1.5之前的7.1.x版本，7.2.0.3之前7.2.0.x版本和7.2.1.x之前7.2.1.1版本存在权限提升漏洞。允许远程攻击AD用户通过未明向量获得root权限。

Severity: 高

Patch Name: EMC Isilon OneFS操作系统权限提升漏洞的补丁

Patch Description:

EMC Isilon OneFS Operating System是集文件系统、卷管理器及数据防护于一体的智能文件系统。

EMC Isilon OneFS操作系统7.1.1.5之前的7.1.x版本，7.2.0.3之前7.2.0.x版本和7.2.1.x之前7.2.1.1版本存在权限提升漏洞。允许远程攻击AD用户通过未明向量获得root权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可联系供应商获得补丁信息： https://sso.emc.com/

Reference: http://seclists.org/bugtraq/2015/Nov/att-121/ESA-2015-164.txt https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6848

Impacted products

Name
['EMC Isilon OneFS 7.1.x(<7.1.1.5)', 'EMC Isilon OneFS 7.2.0.x(<7.2.0.3)', 'EMC Isilon OneFS 7.2.1.x (<7.2.1.1)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-6848"
    }
  },
  "description": "EMC Isilon OneFS Operating System\u662f\u96c6\u6587\u4ef6\u7cfb\u7edf\u3001\u5377\u7ba1\u7406\u5668\u53ca\u6570\u636e\u9632\u62a4\u4e8e\u4e00\u4f53\u7684\u667a\u80fd\u6587\u4ef6\u7cfb\u7edf\u3002\r\n\r\nEMC Isilon OneFS\u64cd\u4f5c\u7cfb\u7edf7.1.1.5\u4e4b\u524d\u76847.1.x\u7248\u672c\uff0c7.2.0.3\u4e4b\u524d7.2.0.x\u7248\u672c\u548c7.2.1.x\u4e4b\u524d7.2.1.1\u7248\u672c\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fbAD\u7528\u6237\u901a\u8fc7\u672a\u660e\u5411\u91cf\u83b7\u5f97root\u6743\u9650\u3002",
  "discovererName": "EMC",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://sso.emc.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-07847",
  "openTime": "2015-11-30",
  "patchDescription": "EMC Isilon OneFS Operating System\u662f\u96c6\u6587\u4ef6\u7cfb\u7edf\u3001\u5377\u7ba1\u7406\u5668\u53ca\u6570\u636e\u9632\u62a4\u4e8e\u4e00\u4f53\u7684\u667a\u80fd\u6587\u4ef6\u7cfb\u7edf\u3002\r\n\r\nEMC Isilon OneFS\u64cd\u4f5c\u7cfb\u7edf7.1.1.5\u4e4b\u524d\u76847.1.x\u7248\u672c\uff0c7.2.0.3\u4e4b\u524d7.2.0.x\u7248\u672c\u548c7.2.1.x\u4e4b\u524d7.2.1.1\u7248\u672c\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fbAD\u7528\u6237\u901a\u8fc7\u672a\u660e\u5411\u91cf\u83b7\u5f97root\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "EMC Isilon OneFS\u64cd\u4f5c\u7cfb\u7edf\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "EMC Isilon OneFS 7.1.x(\u003c7.1.1.5)",
      "EMC Isilon OneFS  7.2.0.x(\u003c7.2.0.3)",
      "EMC Isilon OneFS  7.2.1.x (\u003c7.2.1.1)"
    ]
  },
  "referenceLink": "http://seclists.org/bugtraq/2015/Nov/att-121/ESA-2015-164.txt\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6848",
  "serverity": "\u9ad8",
  "submitTime": "2015-11-27",
  "title": "EMC Isilon OneFS\u64cd\u4f5c\u7cfb\u7edf\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2015-6848 (GCVE-0-2015-6848)

Vulnerability from cvelistv5

Published

2015-11-27 02:00

Modified

2024-08-06 07:36

Severity ?

CWE

Summary

EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.

References

▼	URL	Tags
	http://seclists.org/bugtraq/2015/Nov/121	mailing-list, x_refsource_BUGTRAQ

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:36:34.178Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20151124 ESA-2015-164: EMC Isilon OneFS Privilege Escalation Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://seclists.org/bugtraq/2015/Nov/121"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-11-27T02:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "20151124 ESA-2015-164: EMC Isilon OneFS Privilege Escalation Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://seclists.org/bugtraq/2015/Nov/121"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2015-6848",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20151124 ESA-2015-164: EMC Isilon OneFS Privilege Escalation Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://seclists.org/bugtraq/2015/Nov/121"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2015-6848",
    "datePublished": "2015-11-27T02:00:00",
    "dateReserved": "2015-09-10T00:00:00",
    "dateUpdated": "2024-08-06T07:36:34.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted