Detections
Analytics

EMC Avamar ADS / AVE 7.3.x < 7.3.1 Hotfix HOTFIX 290316 / 7.4.x < 7.4.1 Hotfix 291882 / 7.5.x < 7.5.0 Hotfix 291881 Missing Access Control Check Vulnerability (DSA-2018-025)

critical Nessus Plugin ID 109042

Language:

Synopsis

A backup solution running on the remote host is affected by multiple vulnerabilities.

Description

According to its self-reported version number, the EMC Avamar Data Store (ADS) or Avamar Virtual Edition (AVE) software running on the remote host is 7.3.x prior to 7.3.1 Hotfix 290316 (7.3.1.125), 7.4.x prior to 7.4.1 Hotfix 291882 (7.4.1.58), or 7.5.x prior to 7.5.0 Hotfix 291881 (7.5.0.183). It is, therefore, affected by a missing access control check vulnerability. A remote unauthenticated attacker could read or change the Local Download Service (LDLS) credentials.

Solution

Upgrade to EMC Avamar ADS / AVE version 7.3.1 Hotfix 290316 (7.3.1.125) / 7.4.1 Hotfix 291882 (7.4.1.58) / 7.5.0 Hotfix 291881 (7.5.0.183) or later.

See Also

https://seclists.org/fulldisclosure/2018/Apr/14

Plugin Details

Severity: Critical

ID: 109042

File Name: emc_avamar_dsa-2018-025.nasl

Version: 1.7

Type: combined

Family: Misc.

Published: 4/13/2018

Updated: 11/8/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2018-1217

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:emc:avamar, cpe:/a:emc:avamar_data_store, cpe:/a:emc:avamar_server_virtual_edition

Required KB Items: installed_sw/EMC Avamar

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/5/2018

Vulnerability Publication Date: 4/5/2018

Reference Information

CVE: CVE-2018-1217

IAVB: 2018-B-0053