ESA-2017-011: EMC ESRS Policy Manager Undocumented Account Vulnerability

[EMC Product Security Response Center <Security_Alert () emc com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256


ESA-2017-011: EMC ESRS Policy Manager Undocumented Account Vulnerability

EMC Identifier:  ESA-2017-011  

CVE Identifier:  CVE-2017-4976  

Severity:  High  

Severity Rating: CVSS Base Score:  7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)  

Affected products: 
EMC ESRS Policy Manager versions prior to 6.8  
 
Summary: 
EMC ESRS Policy Manager is affected by an undocumented account vulnerability that could potentially be leveraged by 
malicious users to compromise the affected system.

Details:
EMC ESRS Policy Manager contains an undocumented account (OpenDS admin) with a default password. A remote attacker with 
the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP 
directory server. 

Resolution:
The account and default password have been added to EMC Security Remote Services Policy Operations Guide v6.8. 
Customers can change the default password by following steps documented at: https://support.emc.com/kb/483941. Starting 
from EMC ESRS Policy Manager version 6.8 customers are prompted to change the password for this account during the 
installation process.
   
EMC recommends all customers to install or follow instructions to change the default password at the earliest 
opportunity. 

Link To Remedies:
Customers can download software using the links below:
ESRS Policy Manager 6.8 for Linux 64bit
ESRS Policy Manager 6.8 for Windows 64bit

Credits:
EMC would like to thank Travis Emmert from Salesforce for reporting this vulnerability. 
 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZXlYmAAoJEHbcu+fsE81Z+lcH/RHhW2aCYeISDbAAO7ahJVUQ
HESbZLSgiQODdgVNeP9nniXTucVhcmJ4saslR5mAvaRAESH+xG56b41/2kspGr/2
fTZYAcntKA3WQTvGySugHsj2xwwHUEXCtNaEDg/g7YP/4J78VQ7ClVF/wkJqxZSf
TmT0CPvWYZjDYLAtZ7H/F5ciJ1L/K3r7GS+eo7+0s2KdZ0kVO5dj45AurSWb6glh
6R+NcUOUkxsnh2gHfF1m1aFwrFzCcXBNdsk61do47mM6cGJ+AEc2baNkL8u9PjbK
0qjV6P/Wm4ncGujan7wkgasfrha5jc7sqSfiy5JaF/jXtJD6a9S36upVlr0/Bzc=
=jX42
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/