exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

EMC Data Protection Advisor Hardcoded Password

EMC Data Protection Advisor Hardcoded Password
Posted Sep 16, 2017
Authored by rgod | Site emc.com

EMC Data Protection Advisor contains undocumented accounts with hard-coded passwords that could potentially be exploited by malicious users to compromise the affected system. Versions 6.3.x and 6.4.x are affected.

tags | advisory
advisories | CVE-2017-8013
SHA-256 | 3aaf4121fb9b0575cdcc672569f79fb79ba6e1a12da1241bda5dcdda2198838c

EMC Data Protection Advisor Hardcoded Password

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ESA-2017-098: EMC Data Protection Advisor Hardcoded Password Vulnerability

EMC Identifier: ESA-2017-098
CVE Identifier: CVE-2017-8013
Severity Rating: CVSS v3 Base Score: 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H)

Affected products:
* EMC Data Protection Advisor versions 6.3.x
* EMC Data Protection Advisor versions 6.4.x

Summary:
EMC Data Protection Advisor contains undocumented accounts with hard-coded passwords that could potentially be exploited by malicious users to compromise the affected system.

Details:
EMC Data Protection Advisor contains undocumented accounts with hard-coded passwords and various privileges. Affected accounts are: "Apollo System Test", "emc.dpa.agent.logon" and "emc.dpa.metrics.logon". An attacker with knowledge of the password could potentially use these accounts via REST APIs to gain unauthorized access to EMC Data Protection Advisor (including potentially access with administrative privileges).

Resolution:
The following EMC Data Protection Advisor release contains resolutions to this vulnerability:
* EMC Data Protection Advisor version 6.4 patch 130
* EMC Data Protection Advisor version 6.3 patch 67

"Apollo System Test" and "emc.dpa.metrics.logon" accounts are no longer required for product functionality and have been removed in versions listed above.

The password for "emc.dpa.agent.logon" account can be now changed via the remediated patches listed above. See release notes for more information.

EMC recommends all customers upgrade at the earliest opportunity.


Link to remedies:
Registered EMC Online Support customers can download the required patch from support.emc.com at https://support.emc.com/downloads/829_Data-Protection-Advisor
If you have any questions, contact DELL/EMC Support.

Credits:
EMC would like to thank rgod working with Trend Micro's Zero Day Initiative, for reporting this issue.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZuS8nAAoJEHbcu+fsE81ZpsYH/1dCtL7yvXP9PzWayZ+rkp0H
9tPyftwFfObW7LhUqfVfUPafsoZrU6RFmHlVgwGe2p2xAYM9DroFxhDAh2yL1+W7
1XkL5OGtVA+RE+zt4mrAle+lUP+2esg+hg/uijTeC1xlwtNZRKp3sOCBmwIqqhzv
g3j7XTn6jWXDRnBeY8EOMv/9J5ArmF/CWqeDIEclSMCytNI3j5CLi5nuuowEd79p
eWxoYE/zSOZGWd/lXG3xG6tzBTe9w/7bkO4u/ZECS6HpOvajtOvprvj2rE+dV4qR
MIycphNyNHgFhaNRv9f/H0srni8boTDcQehUWGdEO7vXEnBHyBucNNnxKuRmyUM=
=KDW2
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    8 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close