var-201805-0734
Vulnerability from variot
Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed. Multiple Dell EMC Products are prone to multiple remote command-injection vulnerabilities. Successfully exploiting these issues may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. Customers can refer to Dell EMC target code information at: https://support.emc.com/docu39695_Target_Revisions_and_Adoption_Rates.pdf?language=en_US&language=en_US.
Link to remedies: Registered Dell EMC Support customers can download Dell EMC Unity software from the Dell EMC Online Support web site. https://support.emc.com/downloads/39949_Dell-EMC-Unity-Family
Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867.
For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iQEcBAEBCAAGBQJa6xEFAAoJEHbcu+fsE81ZL2gIAIfkwyT237qfIpxrPZdUKyJB X/HijxN0DU6xLdCw4kzjFCt4I1piYb+Sw/HPPJGfwIXG68oPLrlvJS3cONrEUF3N 7xMEV0qUvrwKApIviJbmNnoOPJeqMYNVY6SXm/iZdsNLNC2YHNmDkpx0KbPJ6G8f bX0GRyaMDA63WK9BGstrFR1MT3gEuCBnem5SC7k6w4dzOTL/ZcQXtNcYIEP1ubV6 9RKZkKr5EYkjB0XcS43knXVyHY9InJq+gxu1R86yz2pusd9WyCn7zTewHQHyVQrv /kCwkaJ57CoFVgKrQj/AzCrBTtia8E5e3hdE93bQncSlacUFE/aBfF4eQ/j2hcY= =IJQe -----END PGP SIGNATURE-----
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201805-0734", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "emc unity operating environment", "scope": "lt", "trust": 1.8, "vendor": "dell", "version": "4.3.0.1522077968" }, { "model": "emc unityvsa operating environment", "scope": "lt", "trust": 1.0, "vendor": "dell", "version": "4.3.0.1522077968" }, { "model": "emc unityvsa operating environment", "scope": null, "trust": 0.8, "vendor": "dell", "version": null }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.0.0.7329527" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.0.2.8627717" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.1.0.9058043" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.0.1.8404134" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.0.1.8320161" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.1.0.8940590" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.0.1.8194551" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.1.0.8959731" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.1.1.9138882" }, { "model": "emc unity operating environment", "scope": "eq", "trust": 0.6, "vendor": "dell", "version": "4.1.2.9257522" }, { "model": "unityvsa operating environment", "scope": "eq", "trust": 0.3, "vendor": "emc", "version": "0" }, { "model": "unity operating environment", "scope": "eq", "trust": 0.3, "vendor": "emc", "version": "0" }, { "model": "unityvsa operating environment", "scope": "ne", "trust": 0.3, "vendor": "emc", "version": "4.3.0.1522077968" }, { "model": "unity operating environment", "scope": "ne", "trust": 0.3, "vendor": "emc", "version": "4.3.0.1522077968" } ], "sources": [ { "db": "BID", "id": "104092" }, { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "CNNVD", "id": "CNNVD-201805-221" }, { "db": "NVD", "id": "CVE-2018-1239" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:dell:emc_unity_operating_environment", "vulnerable": true }, { "cpe22Uri": "cpe:/a:dell:emc_unityvsa_operating_environment", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-004805" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The vendor reported these issues.", "sources": [ { "db": "BID", "id": "104092" } ], "trust": 0.3 }, "cve": "CVE-2018-1239", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.0, "id": "CVE-2018-1239", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 1.8, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 8.0, "id": "VHN-122344", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 1.2, "id": "CVE-2018-1239", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "trust": 1.8, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2018-1239", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "CVE-2018-1239", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-201805-221", "trust": 0.6, "value": "CRITICAL" }, { "author": "VULHUB", "id": "VHN-122344", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-122344" }, { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "CNNVD", "id": "CNNVD-201805-221" }, { "db": "NVD", "id": "CVE-2018-1239" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed. Multiple Dell EMC Products are prone to multiple remote command-injection vulnerabilities. \nSuccessfully exploiting these issues may allow an attacker to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. \nCustomers can refer to Dell EMC target code information at: https://support.emc.com/docu39695_Target_Revisions_and_Adoption_Rates.pdf?language=en_US\u0026language=en_US. \n \n\nLink to remedies:\nRegistered Dell EMC Support customers can download Dell EMC Unity software from the Dell EMC Online Support web site. \nhttps://support.emc.com/downloads/39949_Dell-EMC-Unity-Family \n\n\nRead and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867. \n\nFor an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. \n\nEMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided \"as is\" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v2\n\niQEcBAEBCAAGBQJa6xEFAAoJEHbcu+fsE81ZL2gIAIfkwyT237qfIpxrPZdUKyJB\nX/HijxN0DU6xLdCw4kzjFCt4I1piYb+Sw/HPPJGfwIXG68oPLrlvJS3cONrEUF3N\n7xMEV0qUvrwKApIviJbmNnoOPJeqMYNVY6SXm/iZdsNLNC2YHNmDkpx0KbPJ6G8f\nbX0GRyaMDA63WK9BGstrFR1MT3gEuCBnem5SC7k6w4dzOTL/ZcQXtNcYIEP1ubV6\n9RKZkKr5EYkjB0XcS43knXVyHY9InJq+gxu1R86yz2pusd9WyCn7zTewHQHyVQrv\n/kCwkaJ57CoFVgKrQj/AzCrBTtia8E5e3hdE93bQncSlacUFE/aBfF4eQ/j2hcY=\n=IJQe\n-----END PGP SIGNATURE-----\n\n\n", "sources": [ { "db": "NVD", "id": "CVE-2018-1239" }, { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "BID", "id": "104092" }, { "db": "VULHUB", "id": "VHN-122344" }, { "db": "PACKETSTORM", "id": "147494" } ], "trust": 2.07 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://www.scap.org.cn/vuln/vhn-122344", "trust": 0.1, "type": "unknown" } ], "sources": [ { "db": "VULHUB", "id": "VHN-122344" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2018-1239", "trust": 2.9 }, { "db": "BID", "id": "104092", "trust": 1.4 }, { "db": "JVNDB", "id": "JVNDB-2018-004805", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201805-221", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "147494", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-122344", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-122344" }, { "db": "BID", "id": "104092" }, { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "PACKETSTORM", "id": "147494" }, { "db": "CNNVD", "id": "CNNVD-201805-221" }, { "db": "NVD", "id": "CVE-2018-1239" } ] }, "id": "VAR-201805-0734", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-122344" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T23:12:08.011000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "An Introduction to Unity Software | Dell EMC US", "trust": 0.8, "url": "https://www.dellemc.com/en-us/documentation/unity-family/unity-p-software-upgrades/01-unity-upg-br-introduction.htm" }, { "title": "Dell EMC UnityVSA", "trust": 0.8, "url": "https://www.emc.com/products-solutions/trial-software-download/unity-vsa.htm" }, { "title": "Dell EMC Unity Operating Environment Fixes for operating system command injection vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79905" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "CNNVD", "id": "CNNVD-201805-221" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-78", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-122344" }, { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "NVD", "id": "CVE-2018-1239" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.8, "url": "http://seclists.org/fulldisclosure/2018/may/15" }, { "trust": 1.1, "url": "http://www.securityfocus.com/bid/104092" }, { "trust": 0.9, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-1239" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1239" }, { "trust": 0.3, "url": "http://www.emc.com/" }, { "trust": 0.1, "url": "https://support.emc.com/downloads/39949_dell-emc-unity-family" }, { "trust": 0.1, "url": "https://support.emc.com/docu39695_target_revisions_and_adoption_rates.pdf?language=en_us\u0026language=en_us." } ], "sources": [ { "db": "VULHUB", "id": "VHN-122344" }, { "db": "BID", "id": "104092" }, { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "PACKETSTORM", "id": "147494" }, { "db": "CNNVD", "id": "CNNVD-201805-221" }, { "db": "NVD", "id": "CVE-2018-1239" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-122344" }, { "db": "BID", "id": "104092" }, { "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "db": "PACKETSTORM", "id": "147494" }, { "db": "CNNVD", "id": "CNNVD-201805-221" }, { "db": "NVD", "id": "CVE-2018-1239" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-05-08T00:00:00", "db": "VULHUB", "id": "VHN-122344" }, { "date": "2018-05-03T00:00:00", "db": "BID", "id": "104092" }, { "date": "2018-06-27T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "date": "2018-05-04T01:19:14", "db": "PACKETSTORM", "id": "147494" }, { "date": "2018-05-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201805-221" }, { "date": "2018-05-08T13:29:01.850000", "db": "NVD", "id": "CVE-2018-1239" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-01-07T00:00:00", "db": "VULHUB", "id": "VHN-122344" }, { "date": "2018-05-03T00:00:00", "db": "BID", "id": "104092" }, { "date": "2018-06-27T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-004805" }, { "date": "2018-05-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201805-221" }, { "date": "2024-11-21T03:59:26.677000", "db": "NVD", "id": "CVE-2018-1239" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "PACKETSTORM", "id": "147494" }, { "db": "CNNVD", "id": "CNNVD-201805-221" } ], "trust": 0.7 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Dell EMC Unity Operating Environment In OS Command injection vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-004805" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "operating system commend injection", "sources": [ { "db": "CNNVD", "id": "CNNVD-201805-221" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.