CVE-2014-2959

logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 (646G.GS002) allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter.

CVSS v2.0 9.0 HIGH

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:P/A:P

Exploitability : 10.0 / Impact : 8.5

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/59019
http://www.kb.cert.org/vuls/id/124908	US Government Resource
http://www.securityfocus.com/bid/67751

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:powervault_ml6000_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:dell:powervault_ml6000:32u:::::::*
	cpe:2.3:h:dell:powervault_ml6000:41u:::::::*

Configuration 2 (hide)

AND

cpe:2.3:o:quantum:scalar_i500_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:quantum:scalar_i500:5u:::::::*
	cpe:2.3:h:quantum:scalar_i500:14u:::::::*
	cpe:2.3:h:quantum:scalar_i500:23u:::::::*

History

No history.

Information

Published : 2014-06-02 19:55

Updated : 2024-02-04 18:35

NVD link : CVE-2014-2959

Mitre link : CVE-2014-2959

CVE.ORG link : CVE-2014-2959

JSON object : View

Products Affected

quantum

scalar_i500_firmware
scalar_i500

dell

powervault_ml6000_firmware
powervault_ml6000

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2014-2959", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 8.5, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-02T19:55:03.500", "references": [{"url": "http://secunia.com/advisories/59019", "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/124908", "tags": ["US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/67751", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 (646G.GS002) allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter."}, {"lang": "es", "value": "logViewer.htm en el sistema de copias de seguridad de cintas Dell ML6000 con firmware anterior a i8.2.0.2 (641G.GS103) y el sistema de copias de seguridad de cintas Quantum Scalar i500 con firmware anterior a i8.2.2.1 (646G.GS002) permite a atacantes remotos ejecutar comandos arbitrarios a trav\u00e9s de metacaracteres de shell en un par\u00e1metro de nombre de ruta."}], "lastModified": "2014-06-26T04:50:04.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:powervault_ml6000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DFB91B9-A601-4F22-A1D2-D9DD5C8F9385", "versionEndIncluding": "i8.2.0.1_\\(641g.gs003\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:powervault_ml6000:32u:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "136C9AB1-37AE-43EE-BAAC-39277789B734"}, {"criteria": "cpe:2.3:h:dell:powervault_ml6000:41u:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33A96FD1-2005-41BE-ACE5-33AC136F7206"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:quantum:scalar_i500_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E26485A-B28F-42DF-8650-59A7D7C9D554", "versionEndIncluding": "i8.2.2.1_\\(646g.gs002\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:quantum:scalar_i500:5u:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6AA8B64-A78C-4B51-B29B-21CF2AEF9484"}, {"criteria": "cpe:2.3:h:quantum:scalar_i500:14u:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6FFB7DA-15EB-4053-9440-A30F8E434F5C"}, {"criteria": "cpe:2.3:h:quantum:scalar_i500:23u:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C39DFB77-7945-4CA0-9B66-AF3908FE515D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cret@cert.org"}