Next Page >>
Knowledge Base
A vulnerability exists in EMC Data Protection Advisor in which sensitive information may be exposed in clear text in the configuration file.
Vulnerability Details:
In certain situations, sensitive account credentials may potentially be displayed in clear text in the DPA configuration file. The credentials are not stored in clear text by default or during normal operation of the product. Review EMC Knowledgebase solution <A href="http://solutions.emc.com/emcsolutionview.asp?id=esg122538">esg122538</A> to determine if your existing installation has already been exposed to this issue.
Problem Resolution:
The following EMC Data Protection Advisor products contain resolution to this issue:
A vulnerability exists in EMC Replication Manager which is embedded in NetWorker Module for Microsoft Applications (NMM). The vulnerability may allow arbitrary code execution on vulnerable installations of the product.
Vulnerability Details:
EMC Replication Manager contains a potential vulnerability that may allow remote unauthenticated user to execute arbitrary code on vulnerable installations of EMC Replication Manager (Refer to EMC Knowledgebase solution emc260506 for details on ESA-2011-004). Because NetWorker Module for Microsoft Applications embeds Replication Manager code, NMM users were also determined to be vulnerable.
Problem Resolution:
The following EMC products contain resolutions to this issue:
to the upgrade.
- The sfcbd daemon is running (sfcbd runs by default).
Workaround
A workaround that can be applied to ESXi 4.1 is described in VMware
Knowledge Base Article KB 1031761
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4573 to this issue.
Column 4 of the following table lists the action required to
EMC Ionix Adapter for Alcatel-Lucent 5620 SAM EMS (ASAM) 3.2.0.3 and later
EMC Ionix IP Management Suite (IP) 8.1.2 and later
EMC Ionix Service Assurance Management Suite (SAM) 8.1.1 and later
EMC Ionix VoIP Availability Management Suite (VoIP AM) 4.0.0.4 and later
EMC strongly recommends all customers upgrade at the earliest opportunity. EMC will communicate the fixes for all other affected products as they become available. Regularly check EMC Knowledgebase solution emc274245 for the status of these fixes.
Link to remedies:
Registered EMC Powerlink customers can download software from Powerlink. For EMC Ionix Software, navigate in Powerlink to Home > Support > Software Downloads and Licensing > Downloads E-I
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
-- Vendor Response:
EMC states:
This issue has been resolved in EMC Documentum eRoom 7.4.2. EMC strongly
recommends customers upgrade to EMC Documentum eRoom 7.4.2. More
information on this can be found an powerlink.emc.com (Knowledge Base
esg99041).
OpenText states:
This issue has been resolved in the latest Search Server 6.0 and 6.1
patches for all platforms. More information on the fix can be found in
The following EMC Captiva eInput products contain resolution to these issues.
EMC Captiva eInput 2.1 Hot Fix 2.1.1.37
EMC strongly recommends all customers upgrade at the earliest opportunity. Refer to EMC Knowledgebase solution esg123198 for more details.
Link to remedies:
Registered EMC Powerlink customers can download software from Powerlink.
Concerns Windows SharePoint Services 2.0 Service Pack 3
Knowledge Base (KB) Articles: KB923643
Date Published: 9/17/2007
Two serious functionality issues after installing this service pack. See following thread for details...
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=2173615&SiteID=1
in brief
i) Pages with customized data view web parts or data view web parts linked to lists on other sites are not accesible. Error message either "access denied" or "Unable to display this Web Part. To troubleshoot the problem, open this Web page in a Windows SharePoint Services-compatible HTML editor such as FrontPage. If the problem persists, contact your Web server administrator."
For EMC NetWorker Software documentation, navigate in Powerlink to Home > Support > Technical Documentation and Advisories > Software J-O Documentation > NetWorker Family > NetWorker and select the applicable NetWorker version.
Credits:
EMC would like to thank Tal Zeltzer working with TippingPoint's Zero Day Initiative (http://www.zerodayinitiative.com) for reporting this issue.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
EMC Corporation distributes EMC Security Advisories in order to bring to the attention of users of the affected EMC products important security information. EMC recommends all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall EMC or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
iDefense is currently unaware of any workarounds for this issue.
VI. VENDOR RESPONSE
Trend Micro has addressed this vulnerability by releasing a HotFix. For
more information consult their Knowledge Base article at the following
URL.
http://esupport.trendmicro.com/support/consumer/search.do?cmd=displayKC&externalId=PUB-en-1035845
VII. CVE INFORMATION
http://www.rsa.com. Please read the release notes for more information.
Common Vulnerability Scoring System (CVSS) Base Score:
The Common Vulnerability Scoring System (CVSS) Base Score for the items
identified in this advisory is 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N).
For more information on CVSS scoring, please see the Knowledge Base
Article, “Security Advisories Severity Rating” at
https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a46604.
Credits:
RSA would like to thank Tim Brown of Portcullis Computer Security Ltd for
Asset Management
Remote Control
End-User Web Portal
My Desktop
Mobile Application
Knowledge Base
Reports & Analysis
IT Benchmark
Online Chat
Calendar & Scheduling
have permission to view certain downloads. Should you not see a software
download you believe you should have access to, follow the instructions
in
EMC Knowledgebase solution emc116045.
Credits:
Link to remedies:
Registered EMC Powerlink customers can download software from Powerlink.
For EMC AutoStart Software, navigate in Powerlink to Home > Support > Software Downloads and Licensing > Downloads A-B > AutoStart
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
Credits:
EMC would like to thank Sebastian Apelt (www.siberas.de) working with TippingPoint's Zero Day Initiative (http://www.zerodayinitiative.com) for reporting these issues.
For explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends that all customers take into account both the base score and any relevant temporal and environmental scores, which may impact the potential severity associated with particular security vulnerability.
vulnerable code is owned by the IE team this also affects Office
(including 2010). Core offers to postpone publication of its advisory
from July 13th to August 10th on the basis of a firm commitment to a
release date from the vendor's side. Core informs that it is evaluating
the possibility of using Office killbit recently introduced by MS10-036
as a workaround, but that MS10-036 points to a knowledge base article
[2] that is no longer available.
. 2010-07-07:
Vendor acknowledges previous mail, and states that it will determine
with the product team how this fix could be included in the August
any other file on the visitor's file system.
The problem is derived from the sequence of actions performed by
Internet Explorer to determine the content-type of the content to be
loaded and the appropriate way to render it. The algorithm followed for
this purpose is described in Microsoft's Knowledgebase article titled
MIME Type Detection in Internet Explorer [4] and implemented in the
function 'FindMimeFromData' in 'URLMON.DLL'[5].
In the following section, proof of concept code is provided to
demonstrate the problem using the local storage used by Internet
Registered EMC Powerlink customers can download software from Powerlink.
For EMC Documentum eRoom Software, navigate in Powerlink to Home > Support > Software Downloads and Licensing > Downloads D > Documentum eRoom.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
For explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends that all customer take into account both the base score and any relevant temporal and environmental scores, which may impact the potential severity associated with particular security vulnerability.
EMC Corporation distributes EMC Security Advisories in order to bring to the attention of users of the affected EMC products important security information. EMC recommends all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall EMC or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion of limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Registered EMC Powerlink customers can download sofware from Powerlink. Select the following link, and navigate to the Content Server directory.
https://emc.subscribenet.com/control/dctm/product?plneID=38951
Download the appropriate version for your needs, instructions for application and installation are included in the software downloads readme files or patch release notes. Documentum xPlore 1.1 patches can be found under the Documentum Content Server 6.7 directory. To obtain the Documentum xPlore 1.2 hotfix, please contact Customer Support.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
EMC Corporation distributes EMC Security Advisories in order to bring to the attention of users of the affected EMC products important security information. EMC recommends all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall EMC or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
The patch may be obtained from:
http://www.websense.com (Hotfix #80)
Knowledge Base #1840
http://www.websense.com/SupportPortal/SupportKbs/1840.aspx
===============================
For Replication Manager Software, navigate in Powerlink to Home > Support > Software Downloads and Licensing > Downloads P-R > Replication Manager.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
For explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends that all customers take into account both the base score and any relevant temporal and environmental scores, which may impact the potential severity associated with particular security vulnerability.
For 7.6 SP1 and 7.6 users:
The fix is available in 7.6.1.2 and subsequent cumulative build releases. For details on the 7.6.1.x cumulative fix releases including download details, refer to the NetWorker 7.6 Cumulative Hotfix Summary document on EMC Powerlink.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
For explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends that all customers take into account both the base score and any relevant temporal and environmental scores, which may impact the potential severity associated with particular security vulnerability.
Downloads and Licensing > Downloads C > Celerra Software.
Because the view is restricted based on customer agreements, you may not
have permission to view certain downloads. Should you not see a software
download you believe you should have access to, follow the instructions in
EMC Knowledgebase solution emc116045.
Workaround:
1. Create IP-based access rules on the network equipment rejecting traffic
for IP addresses belonging to the internal Celerra network. These addresses
No workarounds exist at this point. However Microsoft has been contacted
so they can produce a fix for their customers. NGS has been advised that
although this issue will not be patched until the next release of
SharePoint, Microsoft has addressed the design issues around it in a
Knowledge Base article (KB976829) about security considerations when
running SharePoint that can be found at:
http://go.microsoft.com/fwlink/?LinkId=167936
NGS Software wants to thank the MSRC team and Charles Weidner in
Registered EMC Powerlink customers can download software from Powerlink.
For EMC Documentum eRoom Software, navigate in Powerlink to Home > Support > Software Downloads and Licensing > Downloads D > Documentum eRoom
EMC has created an eRoom Sizing Tool with related documentation that helps customers with the eRoom deployment sizing process. EMC strongly recommends that eRoom Administrators read and understand the provided documentation, run the eRoom Sizing Tool and review its results, perform the eRoom 7.4.3 upgrade to a test or staging environment, and complete thorough performance testing in the test or staging environment prior to a production upgrade. Failure to complete these steps may lead to an unplanned eRoom 7.4.3 outage. Refer to EMC ETA esg112401 for the details.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
Credits:
EMC would like to thank Stephen Fewer of Harmony Security (www.harmonysecurity.com) working with TippingPoint's Zero Day Initiative (http://www.zerodayinitiative.com) for reporting this issue.
For explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends that all customers take into account both the base score and any relevant temporal and environmental scores, which may impact the potential severity associated with particular security vulnerability.
Credits:
RSA would like to thank Filip Palian for reporting issues under
CVE-2012-0399, CVE-2012-0400, CVE-2012-0401 and CVE-2012-0402.
For more information on CVSS scoring, please see the Knowledge Base
Article, "Security Advisories Severity Rating" at
https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?
solution=a46604 . RSA recommends that all customers take into account both
the base score and any relevant temporal and environmental scores, which
may impact the potential severity
Link to remedies:
Registered EMC Powerlink customers can download software from Powerlink. Select Home > Support > Software Downloads and Licensing > Downloads S> SourceOne Email Management.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
EMC Corporation distributes EMC Security Advisories in order to bring to the attention of users of the affected EMC products important security information. EMC recommends all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall EMC or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Link to remedies:
Registered EMC Powerlink customers can download software from Powerlink.
For EMC NetWorker Software, navigate in Powerlink to Home > Support > Technical Documentation and Advisories > Software J-O Documentation > NetWorker Family > NetWorker and select the applicable NetWorker version.
Because the view is restricted based on customer agreements, you may not have permission to view certain downloads. Should you not see a software download you believe you should have access to, follow the instructions in EMC Knowledgebase solution emc116045.
Credits: EMC would like to thank Stefan Wuensch of Harvard University for reporting this issue.
For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.
ESXi any ESXi not affected
ESX any ESX not affected
* Refer to VMware Knowledge Base article 1035509 for the updated
version of vmrun for Workstation 6.5.x.
4. Solution
** McAfee Security Bulletin - Common Management Agent 3.6.0 format string
vulnerability with debug level set to 8 **
https://knowledge.mcafee.com/SupportSite/search.do?cmd=displayKC&docType=kc&externalId=615103&sliceId=SAL_Public
This knowledgebase article shows the following versions as vulnerable:
CMA 3.6.0.574 (Patch3) or earlier
McAfee Agent (MA) 4.0
You need to change the debug level of the CMA product before you are at
The vulnerability has been fixed within the latest version which is 7.2. This is set to be released Friday, October 23, 2009.
Websense would like to thank Nikolas for working with us on the issue.
Websense customers can get the new version for free through mywebsense.com and details on the security fix are in the release notes and within our Knowledge Base.
Thanks
-----Original Message-----
From: full-disclosure-bounces@lists.grok.org.uk [mailto:full-disclosure-bounces@lists.grok.org.uk] On Behalf Of NSO Research
the following products.
FLEXnet InstallShield 12 Professional (with InstallShield 12 SP2)
FLEXnet InstallShield 12 Premier (with InstallShield 12 SP2)
For more information, consult their Knowledge Base article at the
following URL.
http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640
VII. CVE INFORMATION
Next Page>>
|
