PT-2013-2724

Name of the Vulnerable Software and Affected Versions EMC AlphaStor version 4.0 before build 814 Description The issue is related to a buffer overflow in the Drive Control Program DCP that allows remote attackers to execute arbitrary code. This is achieved via vectors involving a new device name...

CVE-2013-0930: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Drive Control Program DCP in EMC AlphaStor 4.0 before build 814 allows remote attackers to execute arbitrary code via vectors involving a new device name...

EMC AlphaStor security vulnerabilities

Command injection, format string vulnerability...

Re: EMC Avamar: World writable cache files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-003: EMC Avamar Client Elevation of Privilege Vulnerability EMC Identifier: ESA-2013-003 CVE Identifier: CVE-2012-2291 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected Products: EMC Avamar HP-UX Client 4.x, 5.x and...

EMC Avamar weak permissions

Cache files are world writable...

ESA-2013-008: EMC AlphaStor Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-008: EMC AlphaStor Multiple Vulnerabilities EMC Identifier: ESA-2013-008 EMC Identifier: NW146708 CVE Identifier: CVE-2013-0928, CVE-2013-0929 Severity Rating: See below for individual severity scores Affected product: EMC AlphaStor 4.0 prior...

CVE-2013-0928

The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation...

CVE-2013-0929

Format string vulnerability in the vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command...

Command injection

The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation...

Format string

Format string vulnerability in the vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command...

CVE-2012-2291

EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack...

Design/Logic Flaw

EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack...

CVE-2013-0928

The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation...

CVE-2012-2291

EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack...

CVE-2013-0929

CVE-2013-0929 is a format-string vulnerability in EMC AlphaStor’s Device Manager (rrobotd.exe) that processes incoming commands. The issue arises in the _vsnsprintf function, allowing a remote attacker to execute arbitrary code via format string specifiers. Industry advisories document remote exp...

CVE-2013-0929

Format string vulnerability in the vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command...

CVE-2013-0928

CVE-2013-0928 affects EMC AlphaStor, specifically the Device Manager process rrobotd.exe. The vulnerability is a remote command injection flaw exposed via the DCP run command, caused by improper input handling. Versions prior to 4.0 Build 800 are vulnerable; upgrading to 4.0 Build 800 or later is...

CVE-2012-2291

CVE-2012-2291 affects EMC Avamar Client 4.x/5.x/6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x/5.x/6.x for Oracle. The root cause is world-writable permissions on cache directories, which enables local users to elevate privileges via an unspecified symlink attack. The accompanying secur...

CVE-2013-0928: Improper Neutralization of Special Elements used in an OS Command

The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation...

PT-2013-2722

Name of the Vulnerable Software and Affected Versions EMC AlphaStor version 4.0 before build 800 Description The issue allows remote attackers to execute arbitrary commands. This is achieved through a DCP "run command" operation in the NetWorker command processor in rrobotd.exe within the Device...