Vulnerability CVE-2011-1421 - CERT Civis.Net

Vulnerability Name:

CVE-2011-1421 (CCN-66851)

Assigned:

2011-04-19

Published:

2011-04-19

Updated:

2018-10-09

Summary:

EMC NetWorker 7.5.x before 7.5.4.3 and 7.6.x before 7.6.1.5, when the client push feature is enabled, uses weak permissions for an unspecified file, which allows local users to gain privileges via unknown vectors.

CVSS v3 Severity:

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
5.1 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
3.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: CCN
Type: ESA-2011-013
EMC NetWorker arbitrary code execution with elevated privileges vulnerability.

Source: MITRE
Type: CNA
CVE-2011-1421

Source: CCN
Type: SA44237
EMC NetWorker Insecure File Permissions Privilege Escalation Security Issue

Source: SECUNIA
Type: Vendor Advisory
44237

Source: SREASON
Type: UNKNOWN
8214

Source: SECTRACK
Type: UNKNOWN
1025383

Source: CCN
Type: OSVDB ID: 71871
EMC NetWorker Unspecified File Permissions Weakness Local Privilege Escalation

Source: BUGTRAQ
Type: UNKNOWN
20110418 ESA-2011-013: EMC NetWorker arbitrary code execution with elevated privileges vulnerability

Source: BID
Type: UNKNOWN
47410

Source: CCN
Type: BID-47410
EMC NetWorker Unspecified File Remote Code Execution Vulnerability

Source: VUPEN
Type: Vendor Advisory
ADV-2011-1025

Source: XF
Type: UNKNOWN
networker-file-priv-escalation(66851)

Vulnerable Configuration:

Configuration 1:

cpe:/a:emc:networker:7.5.2.0:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.2.1:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.2.2:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.2.3:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.2.4:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3.1:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3.2:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3.3:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3.4:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3.5:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.4:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.4.1:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.4.2:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:emc:networker:7.6:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6:sp1:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.2:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.3:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.4:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.5:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.6:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.7:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.8:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.0.9:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.1.1:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.1.2:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.1.3:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.1.4:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:emc:networker:7.6.1.2:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.6.1.1:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3.5:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5.3.4:*:*:*:*:*:*:*

OR cpe:/a:emc:networker:7.5:sp3:*:*:*:*:*:*

Denotes that component is vulnerable