CVE-2017-8012
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Java Management Extensions (JMX) protocol used to communicate between components in the Alerting and/or Compliance components can be leveraged to create a denial of…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Java Management Extensions (JMX) protocol used to communicate between components in the Alerting and/or Compliance components can be leveraged to create a denial of service (DoS) condition. Attackers with knowledge of JMX agent user credentials could potentially exploit this vulnerability to create arbitrary files on the affected system and create a DoS condition by leveraging inherent JMX protocol capabilities.
- CVSS 3.1
- 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- EPSS
- 1.92% probability · 79th percentile
- CISA KEV
- Not listed
- Affected
- dell/emc m\&r · dell/emc storage monitoring and reporting · dell/emc vipr srm · dell/emc vnx monitoring and reporting
- Source
- security_alert@emc.com
References
- http://seclists.org/fulldisclosure/2017/Sep/51Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/100982Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039417Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039418Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Sep/51Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/100982Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039417Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039418Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.