Lucene search

[email protected]CVE-2017-14380

HistoryDec 13, 2017 - 8:29 p.m.

CVE-2017-14380

2017-12-1320:29:00

CWE-269

[email protected]

web.nvd.nist.gov

emc

isilon

onefs

vulnerability

cve-2017-14380

elevation of privilege

compliance mode

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

12.3%

JSON

In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (compadmin) account user could exploit a vulnerability in isi_get_itrace or isi_get_profile maintenance scripts to run any shell script as system root on a cluster in compliance mode. This could potentially lead to an elevation of privilege for the compadmin user and violate compliance mode.

CPENameOperatorVersion
emc:isilon_onefsemc isilon onefseq7.2.0.5
emc:isilon_onefsemc isilon onefseq7.2.0.0
emc:isilon_onefsemc isilon onefseq7.1.1.5
emc:isilon_onefsemc isilon onefseq7.2.1.4
emc:isilon_onefsemc isilon onefseq7.1.1.3
emc:isilon_onefsemc isilon onefseq7.2.1.1
emc:isilon_onefsemc isilon onefseq7.2.0.3
emc:isilon_onefsemc isilon onefseq8.0.1.0
emc:isilon_onefsemc isilon onefseq8.0.0.0
emc:isilon_onefsemc isilon onefseq7.2.0.4

CPE	Name	Operator	Version
emc:isilon_onefs	emc isilon onefs	eq	7.2.0.5
emc:isilon_onefs	emc isilon onefs	eq	7.2.0.0
emc:isilon_onefs	emc isilon onefs	eq	7.1.1.5
emc:isilon_onefs	emc isilon onefs	eq	7.2.1.4
emc:isilon_onefs	emc isilon onefs	eq	7.1.1.3
emc:isilon_onefs	emc isilon onefs	eq	7.2.1.1
emc:isilon_onefs	emc isilon onefs	eq	7.2.0.3
emc:isilon_onefs	emc isilon onefs	eq	8.0.1.0
emc:isilon_onefs	emc isilon onefs	eq	8.0.0.0
emc:isilon_onefs	emc isilon onefs	eq	7.2.0.4

Rows per page:

1-10 of 261

References

seclists.org/fulldisclosure/2017/Dec/41

www.securityfocus.com/bid/102210

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

12.3%

JSON

Related for CVE-2017-14380

cvelist1 zdt1 prion1