Twenty Year Anniversary

EMC ScaleIO 2.0.1.x DoS / Buffer Overflow / Information Disclosure

EMC ScaleIO 2.0.1.x DoS / Buffer Overflow / Information Disclosure
Posted Nov 21, 2017
Authored by David Berard | Site emc.com

EMC ScaleIO versions 2.0.1.3, 2.0.1.2, 2.0.1.1, and 2.0.1 suffer from information disclosure, denial of service, and buffer overflow vulnerabilities.

tags | advisory, denial of service, overflow, vulnerability, info disclosure
advisories | CVE-2017-8001, CVE-2017-8019, CVE-2017-8020
MD5 | ac99803ad3a4eadd99ad32cc43d3ac13

EMC ScaleIO 2.0.1.x DoS / Buffer Overflow / Information Disclosure

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ESA-2017-094: EMC ScaleIO Multiple Vulnerabilities

EMC Identifier: ESA-2017-094

CVE Identifier: CVE-2017-8001, CVE-2017-8019, CVE-2017-8020

Severity Rating: CVSSv3 Base Score: See below for CVSS scores for individual CVEs

Affected products:
EMC ScaleIO 2.0.1.x version family (2.0.1.3, 2.0.1.2, 2.0.1.1, 2.0.1)

Summary:
EMC ScaleIO contains a number of vulnerabilities which could potentially be exploited by malicious users to compromise an affected system.

Details:
EMC ScaleIO contains the following vulnerabilities:

* Sensitive Information Disclosure (CVE-2017-8001)
In a Linux environment, one of the EMC ScaleIO support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the server where the script was executed to recover exposed credentials.

CVSSv3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

* Denial of Service (CVE-2017-8019)
A vulnerability in ScaleIO message parsers (MDM,SDS, and LIA) could potentially allow an unauthenticated remote attacker to send specifically crafted packets to stop ScaleIO services and cause denial of service situation .

CVSSv3 Base Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

* ScaleIO Debugging (SDBG) Service Buffer Overflow CVE-2017-8020)
A buffer overflow vulnerability in ScaleIO SDBG service may potentially allow a remote unauthenticated attacker to execute arbitrary commands with root privileges on affected server.

CVSSv3 Base Score: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Resolution:
The following EMC ScaleIO release contains resolution to these vulnerabilities:
* EMC ScaleIO version 2.0.1.4

For CVE-2017-8001, EMC recommends all customers follow additional steps documented in knowledgebase article 503560.

Link to remedies:
Customers can download software from https://support.emc.com/downloads/33925_ScaleIO-Software.

Credit:
EMC would like to thank David Berard, from Ubisoft Security & Risk Management team, for reporting these vulnerabilities.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJaEwJcAAoJEHbcu+fsE81Z6ssH/3ULyHNPndX3ZkRb6CT4MRnq
K6iS3DFCacSumvs8O1NjCZFMQH2PkR5AFGx2Ttb308t9/MPimtxIWJt2Cq7ssXAX
PYpvYAiwo0LxFcltfZhJ06PIr1x64CrBWLpZxxiJVZkqpSzqHLfiY1M3CW5eJLEN
7TWX5g6k8PyQ1rAxmtP0AJu1LdacRBsQNWqnKUSf+0JoaPBWpFl5NOqaPCm+YTEt
YIfpWOUbC/R7k22P+/r/TaUw3JiYz+vGFDGs+tVVof5BuB7IgTvioqZHA6mh9W11
nRYGxyil0h/1g9t4/KBFMGpr0XqWGUANSjWOsPxYA5ejTyJvXRK4bsoudP0zLlg=
=lLMW
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

May 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    17 Files
  • 3
    May 3rd
    30 Files
  • 4
    May 4th
    29 Files
  • 5
    May 5th
    2 Files
  • 6
    May 6th
    3 Files
  • 7
    May 7th
    13 Files
  • 8
    May 8th
    27 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    15 Files
  • 11
    May 11th
    8 Files
  • 12
    May 12th
    2 Files
  • 13
    May 13th
    8 Files
  • 14
    May 14th
    7 Files
  • 15
    May 15th
    43 Files
  • 16
    May 16th
    19 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    3 Files
  • 20
    May 20th
    6 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    3 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close