EMC Avamar ADS / AVE 7.2.x < 7.2.1 Hotfix 277897 / 7.3.x < 7.3.1 Hotfix 276676 / 7.4.x < 7.4.1 Hotfix 279294 Multiple Vulnerabilities (ESA-2017-054)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

A backup solution running on the remote host is affected by multiple
vulnerabilities.

Description :

According to its self-reported version number, the EMC Avamar Data
Store (ADS) or Avamar Virtual Edition (AVE) software running on the
remote host is 7.2.x prior to 7.2.1 Hotfix 277897 (7.2.1.32), 7.3.x
prior to 7.3.1 Hotfix 276676 (7.3.1.125), or 7.4.x prior to 7.4.1
Hotfix 279294 (7.4.1.58). It is, therefore, affected by multiple
vulnerabilities :

- An authentication bypass vulnerability exists that
allows an unauthenticated, remote attacker to bypass
authentication and gain access to the system maintenance
page. Note that this vulnerability does not affect the
7.4.x version branch. (CVE-2017-4989)

- A remote code execution vulnerability exists in the file
upload feature of the system maintenance page due to
improper validation of file types and extensions of
uploaded files before being placed in a user-accessible
path. An unauthenticated, remote attacker can exploit
this to upload a specially crafted file and then request
it in order to execute arbitrary code. Note that this
vulnerability does not affect the 7.2.x version branch.
(CVE-2017-4990)

See also :

http://seclists.org/bugtraq/2017/Jun/att-40/ESA-2017-054.txt

Solution :

Upgrade to EMC Avamar ADS / AVE version 7.2.1 Hotfix 277897 (7.2.1.32)
/ 7.3.1 Hotfix 276676 (7.3.1.125) / 7.4.1 Hotfix 279294 (7.4.1.58) or
later.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.3
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Misc.

Nessus Plugin ID: 101110 ()

Bugtraq ID: 99243

CVE ID: CVE-2017-4989
CVE-2017-4990

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now