{"vuid":"VU#581276","idnumber":"581276","name":"EMC AutoStart is vulnerable to remote code execution via specially crafted packets","keywords":["emc","autostart","remote code execution"],"overview":"EMC AutoStart, version 5.5.0 and earlier, is vulnerable to remote command execution via specially crafted packets.","clean_desc":"EMC AutoStart is an enterprise software application developed to help networks and service maintain a high level of availability. AutoStart can manage clusters of applications or nodes as well as single instances. Affected versions of EMC AutoStart fail to communicate securely between nodes, leading to the possibility of packet injection. Remote code execution with SYSTEM or root privileges is possible for attackers with knowledge of the AutoStart domain name. By sending crafted packets to the ftagent running on the remote system, it is possible to run commands to write and execute data to an absolute or relative file path on the remote system.","impact":"A remote, unauthenticated user may be able to execute arbitrary commands with SYSTEM or root privileges.","resolution":"Apply an update EMC has released update 5.5.0.508 (HF4) to address this vulnerability. Please contact EMC Technical Support to request the hot fix (reference hotfix 1073, service alert 1078). Affected users should update to the latest version as soon as possible.","workarounds":"Use a firewall to limit access System administrators can set the system firewall to limit TCP port 8045 access to known good systems that run the EMC AutoStart controller application.","sysaffected":"","thanks":"Thanks to the reporter who wishes to remain anonymous.","author":"This document was written by Garret Wassermann.","public":["h","t","t","p",":","/","/","w","w","w",".","e","m","c",".","c","o","m","/","s","t","o","r","a","g","e","/","a","u","t","o","s","t","a","r","t",".","h","t","m"],"cveids":["CVE-2015-0538"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2014-08-11T15:02:05Z","publicdate":"2015-04-30T00:00:00Z","datefirstpublished":"2015-04-30T20:12:17Z","dateupdated":"2015-04-30T20:12:17Z","revision":38,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"4","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"M","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"C","cvss_exploitablity":null,"cvss_remediationlevel":"W","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"9.3","cvss_basevector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","cvss_temporalscore":"8.4","cvss_environmentalscore":"6.3167135976","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}