cnvd - cnvd-2015-04240

CNVD-2015-04240

Vulnerability from cnvd - Published: 2015-07-06

Title

EMC Secure Remote Services Virtual Edition未授权访问漏洞

Description

EMC Secure Remote Services Virtual Edition是在EMC客户服务和终端用户的EMC产品及解决方案之间提供双向远程连接的远程服务虚拟版软件。 EMC Secure Remote Services Virtual Edition系统创建会话COOKIE不够随机，允许远程攻击者利用漏洞访问目标ESRS接口，控制设备。

Severity

中

Patch Name

EMC Secure Remote Services Virtual Edition未授权访问漏洞的补丁

Patch Description

EMC Secure Remote Services Virtual Edition是在EMC客户服务和终端用户的EMC产品及解决方案之间提供双向远程连接的远程服务虚拟版软件。EMC Secure Remote Services Virtual Edition系统创建会话COOKIE不够随机，允许远程攻击者利用漏洞访问目标ESRS接口，控制设备。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

EMC Secure Remote Services Virtual Edition 3.06已经修复该漏洞，建议用户下载更新： http://www.emc.com/

Reference

http://seclists.org/bugtraq/2015/Jun/att-132/ESA-2015-097.txt

Impacted products

Name
['EMC Secure Remote Services Virtual Edition 3.02', 'EMC Secure Remote Services Virtual Edition 3.03', 'EMC Secure Remote Services Virtual Edition 3.04']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-0544"
    }
  },
  "description": "EMC Secure Remote Services Virtual Edition\u662f\u5728EMC\u5ba2\u6237\u670d\u52a1\u548c\u7ec8\u7aef\u7528\u6237\u7684EMC\u4ea7\u54c1\u53ca\u89e3\u51b3\u65b9\u6848\u4e4b\u95f4\u63d0\u4f9b\u53cc\u5411\u8fdc\u7a0b\u8fde\u63a5\u7684\u8fdc\u7a0b\u670d\u52a1\u865a\u62df\u7248\u8f6f\u4ef6\u3002\r\n\r\nEMC Secure Remote Services Virtual Edition\u7cfb\u7edf\u521b\u5efa\u4f1a\u8bddCOOKIE\u4e0d\u591f\u968f\u673a\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u8bbf\u95ee\u76ee\u6807ESRS\u63a5\u53e3\uff0c\u63a7\u5236\u8bbe\u5907\u3002",
  "discovererName": "EMC",
  "formalWay": "EMC Secure Remote Services Virtual Edition 3.06\u5df2\u7ecf\u4fee\u590d\u8be5\u6f0f\u6d1e\uff0c\u5efa\u8bae\u7528\u6237\u4e0b\u8f7d\u66f4\u65b0\uff1a\r\nhttp://www.emc.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-04240",
  "openTime": "2015-07-06",
  "patchDescription": "EMC Secure Remote Services Virtual Edition\u662f\u5728EMC\u5ba2\u6237\u670d\u52a1\u548c\u7ec8\u7aef\u7528\u6237\u7684EMC\u4ea7\u54c1\u53ca\u89e3\u51b3\u65b9\u6848\u4e4b\u95f4\u63d0\u4f9b\u53cc\u5411\u8fdc\u7a0b\u8fde\u63a5\u7684\u8fdc\u7a0b\u670d\u52a1\u865a\u62df\u7248\u8f6f\u4ef6\u3002EMC Secure Remote Services Virtual Edition\u7cfb\u7edf\u521b\u5efa\u4f1a\u8bddCOOKIE\u4e0d\u591f\u968f\u673a\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u8bbf\u95ee\u76ee\u6807ESRS\u63a5\u53e3\uff0c\u63a7\u5236\u8bbe\u5907\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "EMC Secure Remote Services Virtual Edition\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "EMC Secure Remote Services Virtual Edition 3.02",
      "EMC Secure Remote Services Virtual Edition 3.03",
      "EMC Secure Remote Services Virtual Edition 3.04"
    ]
  },
  "referenceLink": "http://seclists.org/bugtraq/2015/Jun/att-132/ESA-2015-097.txt",
  "serverity": "\u4e2d",
  "submitTime": "2015-07-02",
  "title": "EMC Secure Remote Services Virtual Edition\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e"
}

CVE-2015-0544 (GCVE-0-2015-0544)

Vulnerability from cvelistv5 – Published: 2015-07-05 10:00 – Updated: 2024-08-06 04:10

Summary

EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.

Severity ?

No CVSS data available.

CWE

Assigner

dell

References

URL

Tags

	http://www.securitytracker.com/id/1032740	vdb-entryx_refsource_SECTRACK
	http://seclists.org/bugtraq/2015/Jun/132	mailing-listx_refsource_BUGTRAQ

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:10:11.099Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1032740",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1032740"
          },
          {
            "name": "20150626 ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://seclists.org/bugtraq/2015/Jun/132"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-06-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-23T18:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "name": "1032740",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1032740"
        },
        {
          "name": "20150626 ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://seclists.org/bugtraq/2015/Jun/132"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2015-0544",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1032740",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1032740"
            },
            {
              "name": "20150626 ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://seclists.org/bugtraq/2015/Jun/132"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2015-0544",
    "datePublished": "2015-07-05T10:00:00",
    "dateReserved": "2014-12-17T00:00:00",
    "dateUpdated": "2024-08-06T04:10:11.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2015-04240

CVE-2015-0544 (GCVE-0-2015-0544)

Tags

Sightings

Nomenclature