var-201702-0310
Vulnerability from variot
EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could potentially be exploited by malicious users to compromise the affected system. A local attacker can exploit this issue to bypass the Data Domain restricted shell (ddsh) to gain shell access and execute arbitrary commands with root privileges. An attacker could exploit this vulnerability to take control of an affected system.
Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867.
For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iQEcBAEBCAAGBQJYiiHDAAoJEHbcu+fsE81Zm9YH/jnkR68S9tmkFmoMmgv8opS9 aKZV6pi1wjeaCXhU9i6TMy9MCAD2tk6u5mRYYo7UVJ/suGVkAWkFKUlx0VkYOoB5 6HKV6JS0FaguclFieBqIbYF+uY1xiBZ+fuszavUJ+KAVkPfy6Rjir7Pvn8ackf9l LfDciLLvHzD2Z3pkQWGpIUrxRuamCNDiIn1/N+qhOT+SLqFoX+4NHWoH4IIE1lf9 BY0ctPA+VD8iOZdYwwilj5wWpOupAbdgRS16HWE5IqPqKbqdIKitjZ5SRXYSVK5F 0LWSWUVVBUOos3bDLh+LnGmTEKNG2Y+9sCATMdevm8owMDrY1AJD5kYXKQxQK+8= =26zs -----END PGP SIGNATURE-----
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201702-0310", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "emc data domain os", "scope": "eq", "trust": 1.0, "vendor": "dell", "version": "5.6" }, { "model": "emc data domain os", "scope": "eq", "trust": 1.0, "vendor": "dell", "version": "5.7" }, { "model": "emc data domain os", "scope": "eq", "trust": 1.0, "vendor": "dell", "version": "5.4" }, { "model": "emc data domain os", "scope": "eq", "trust": 1.0, "vendor": "dell", "version": "5.5" }, { "model": "data domain os", "scope": "eq", "trust": 0.9, "vendor": "emc", "version": "5.7" }, { "model": "data domain os", "scope": "eq", "trust": 0.9, "vendor": "emc", "version": "5.6" }, { "model": "data domain os", "scope": "eq", "trust": 0.9, "vendor": "emc", "version": "5.5" }, { "model": "data domain os", "scope": "eq", "trust": 0.9, "vendor": "emc", "version": "5.4" }, { "model": "data domain operating system", "scope": "lt", "trust": 0.8, "vendor": "dell emc old emc", "version": "5.6 family all versions" }, { "model": "data domain operating system", "scope": "eq", "trust": 0.8, "vendor": "dell emc old emc", "version": "5.5.5.0" }, { "model": "data domain operating system", "scope": "eq", "trust": 0.8, "vendor": "dell emc old emc", "version": "5.6.2.0" }, { "model": "data domain operating system", "scope": "lt", "trust": 0.8, "vendor": "dell emc old emc", "version": "5.7 family all versions" }, { "model": "data domain operating system", "scope": "eq", "trust": 0.8, "vendor": "dell emc old emc", "version": "5.7.2.10" }, { "model": "data domain operating system", "scope": "lt", "trust": 0.8, "vendor": "dell emc old emc", "version": "5.5 family all versions" }, { "model": "data domain operating system", "scope": "eq", "trust": 0.8, "vendor": "dell emc old emc", "version": "5.4 all versions" }, { "model": "data domain os", "scope": "eq", "trust": 0.3, "vendor": "emc", "version": "5.7.2.0" }, { "model": "data domain os", "scope": "eq", "trust": 0.3, "vendor": "emc", "version": "5.7.1.0" }, { "model": "data domain os", "scope": "eq", "trust": 0.3, "vendor": "emc", "version": "5.6.1.0" }, { "model": "data domain os", "scope": "eq", "trust": 0.3, "vendor": "emc", "version": "5.5.4.0" }, { "model": "data domain os", "scope": "eq", "trust": 0.3, "vendor": "emc", "version": "5.5.3.3" }, { "model": "data domain os", "scope": "ne", "trust": 0.3, "vendor": "emc", "version": "5.7.2.10" }, { "model": "data domain os", "scope": "ne", "trust": 0.3, "vendor": "emc", "version": "5.6.2.0" }, { "model": "data domain os", "scope": "ne", "trust": 0.3, "vendor": "emc", "version": "5.5.5.0" } ], "sources": [ { "db": "BID", "id": "95829" }, { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "CNNVD", "id": "CNNVD-201702-029" }, { "db": "NVD", "id": "CVE-2016-8216" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:emc:data_domain_os", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-007970" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Geoffrey Janjua from Northrop Grumman.", "sources": [ { "db": "BID", "id": "95829" } ], "trust": 0.3 }, "cve": "CVE-2016-8216", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "id": "CVE-2016-8216", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 1.8, "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 3.9, "id": "VHN-97036", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 0.8, "id": "CVE-2016-8216", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Local", "author": "NVD", "availabilityImpact": "High", "baseScore": 6.7, "baseSeverity": "Medium", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2016-8216", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "High", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2016-8216", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2016-8216", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-201702-029", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-97036", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-97036" }, { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "CNNVD", "id": "CNNVD-201702-029" }, { "db": "NVD", "id": "CVE-2016-8216" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could potentially be exploited by malicious users to compromise the affected system. \nA local attacker can exploit this issue to bypass the Data Domain restricted shell (ddsh) to gain shell access and execute arbitrary commands with root privileges. An attacker could exploit this vulnerability to take control of an affected system. \n\n\n\nRead and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. \n\nFor an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. \n\nEMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided \"as is\" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v2\n\niQEcBAEBCAAGBQJYiiHDAAoJEHbcu+fsE81Zm9YH/jnkR68S9tmkFmoMmgv8opS9\naKZV6pi1wjeaCXhU9i6TMy9MCAD2tk6u5mRYYo7UVJ/suGVkAWkFKUlx0VkYOoB5\n6HKV6JS0FaguclFieBqIbYF+uY1xiBZ+fuszavUJ+KAVkPfy6Rjir7Pvn8ackf9l\nLfDciLLvHzD2Z3pkQWGpIUrxRuamCNDiIn1/N+qhOT+SLqFoX+4NHWoH4IIE1lf9\nBY0ctPA+VD8iOZdYwwilj5wWpOupAbdgRS16HWE5IqPqKbqdIKitjZ5SRXYSVK5F\n0LWSWUVVBUOos3bDLh+LnGmTEKNG2Y+9sCATMdevm8owMDrY1AJD5kYXKQxQK+8=\n=26zs\n-----END PGP SIGNATURE-----\n", "sources": [ { "db": "NVD", "id": "CVE-2016-8216" }, { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "BID", "id": "95829" }, { "db": "VULHUB", "id": "VHN-97036" }, { "db": "PACKETSTORM", "id": "140786" } ], "trust": 2.07 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://www.scap.org.cn/vuln/vhn-97036", "trust": 0.1, "type": "unknown" } ], "sources": [ { "db": "VULHUB", "id": "VHN-97036" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2016-8216", "trust": 2.9 }, { "db": "BID", "id": "95829", "trust": 1.4 }, { "db": "SECTRACK", "id": "1037728", "trust": 1.1 }, { "db": "JVNDB", "id": "JVNDB-2016-007970", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201702-029", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "140786", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-97036", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-97036" }, { "db": "BID", "id": "95829" }, { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "PACKETSTORM", "id": "140786" }, { "db": "CNNVD", "id": "CNNVD-201702-029" }, { "db": "NVD", "id": "CVE-2016-8216" } ] }, "id": "VAR-201702-0310", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-97036" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T22:45:46.917000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "EMC Data Domain \u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0", "trust": 0.8, "url": "https://japan.emc.com/data-protection/data-domain/data-domain-operating-system.htm" }, { "title": "EMC Data Domain OS Fixes for command injection vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67417" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "CNNVD", "id": "CNNVD-201702-029" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-264", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-97036" }, { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "NVD", "id": "CVE-2016-8216" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "http://www.securityfocus.com/archive/1/540059/30/0/threaded" }, { "trust": 1.1, "url": "http://www.securityfocus.com/bid/95829" }, { "trust": 1.1, "url": "http://www.securitytracker.com/id/1037728" }, { "trust": 0.9, "url": "https://nvd.nist.gov/vuln/detail/cve-2016-8216" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8216" }, { "trust": 0.3, "url": "http://www.emc.com/" }, { "trust": 0.3, "url": "http://seclists.org/bugtraq/2017/jan/att-79/esa-2016-160.txt" }, { "trust": 0.1, "url": "https://support.emc.com/downloads/32697_dd-os" } ], "sources": [ { "db": "VULHUB", "id": "VHN-97036" }, { "db": "BID", "id": "95829" }, { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "PACKETSTORM", "id": "140786" }, { "db": "CNNVD", "id": "CNNVD-201702-029" }, { "db": "NVD", "id": "CVE-2016-8216" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-97036" }, { "db": "BID", "id": "95829" }, { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "PACKETSTORM", "id": "140786" }, { "db": "CNNVD", "id": "CNNVD-201702-029" }, { "db": "NVD", "id": "CVE-2016-8216" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-02-03T00:00:00", "db": "VULHUB", "id": "VHN-97036" }, { "date": "2017-01-26T00:00:00", "db": "BID", "id": "95829" }, { "date": "2017-04-03T00:00:00", "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "date": "2017-01-28T08:32:22", "db": "PACKETSTORM", "id": "140786" }, { "date": "2017-02-04T00:00:00", "db": "CNNVD", "id": "CNNVD-201702-029" }, { "date": "2017-02-03T07:59:00.390000", "db": "NVD", "id": "CVE-2016-8216" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-01-23T00:00:00", "db": "VULHUB", "id": "VHN-97036" }, { "date": "2017-02-02T01:03:00", "db": "BID", "id": "95829" }, { "date": "2017-04-03T00:00:00", "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "date": "2017-02-06T00:00:00", "db": "CNNVD", "id": "CNNVD-201702-029" }, { "date": "2024-11-21T02:59:00.273000", "db": "NVD", "id": "CVE-2016-8216" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "BID", "id": "95829" }, { "db": "CNNVD", "id": "CNNVD-201702-029" } ], "trust": 0.9 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "EMC Data Domain OS Command injection vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-007970" }, { "db": "CNNVD", "id": "CNNVD-201702-029" } ], "trust": 1.4 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control", "sources": [ { "db": "CNNVD", "id": "CNNVD-201702-029" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.