NetApp Service Processor CVE-2019-5490 Arbitrary Command Execution Vulnerability
BID:107896
Info
NetApp Service Processor CVE-2019-5490 Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 107896 |
| Class: | Input Validation Error |
| CVE: |
CVE-2019-5490 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 05 2019 12:00AM |
| Updated: | Mar 05 2019 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
NetApp Service Processor 3.1.2 patch2 NetApp Service Processor 3.1.2 patch1 NetApp Service Processor 3.1.2 NetApp Service Processor 3.0.4 NetApp Service Processor 2.4.1 patch1 NetApp Service Processor 2.4.1 NetApp Service Processor 2.3.2 patch3 NetApp Service Processor 2.3.2 patch2 NetApp Service Processor 2.3.2 patch1 NetApp Service Processor 2.3.2 NetApp Service Processor 2.2.5 NetApp Service Processor 5.5 NetApp Service Processor 5.2 patch1 NetApp Service Processor 5.2 NetApp Service Processor 5.1 patch3 NetApp Service Processor 5.1 patch2 NetApp Service Processor 5.1 patch1 NetApp Service Processor 5.1 NetApp Service Processor 4.5 NetApp Service Processor 4.2 patch2 NetApp Service Processor 4.2 patch1 NetApp Service Processor 4.2 NetApp Service Processor 4.1 patch6 NetApp Service Processor 4.1 patch5 NetApp Service Processor 4.1 patch4 NetApp Service Processor 4.1 patch3 NetApp Service Processor 4.1 patch2 NetApp Service Processor 4.1 patch1 NetApp Service Processor 4.1 NetApp Service Processor 3.7 NetApp Service Processor 3.4 patch2 NetApp Service Processor 3.4 patch1 NetApp Service Processor 3.4 NetApp Service Processor 3.3 patch4 NetApp Service Processor 3.3 patch3 NetApp Service Processor 3.3 patch2 NetApp Service Processor 3.3 patch1 NetApp Service Processor 3.3 NetApp Service Processor 3.2 NetApp Service Processor 2.8 NetApp Service Processor 2.5 NetApp Service Processor 2.4 NetApp Data ONTAP operating in 7-Mode 0 NetApp Clustered Data ONTAP 9.5 NetApp Clustered Data ONTAP 9.4 NetApp Clustered Data ONTAP 9.3 NetApp Clustered Data ONTAP 9.2 NetApp Clustered Data ONTAP 9.1 NetApp Clustered Data ONTAP 9.0 NetApp Clustered Data ONTAP 8.3 NetApp Clustered Data ONTAP 8.2 |
| Not Vulnerable: |
NetApp Service Processor 5.5 patch1 NetApp Service Processor 5.2 patch2 NetApp Service Processor 5.1 patch4 NetApp Service Processor 4.5 patch1 NetApp Service Processor 4.2 patch3 NetApp Service Processor 4.1 patch7 NetApp Service Processor 3.7 patch1 NetApp Service Processor 3.4 patch3 NetApp Service Processor 3.3 patch5 NetApp Service Processor 3.2 patch1 NetApp Service Processor 3.1.2 patch3 NetApp Service Processor 2.8 patch1 NetApp Service Processor 2.5 patch1 NetApp Service Processor 2.4.1 patch2 NetApp Service Processor 2.4 patch1 NetApp Service Processor 2.3.2 patch4 NetApp Service Processor 2.2.5 patch1 NetApp Clustered Data ONTAP 9.5P1 NetApp Clustered Data ONTAP 9.4P6 NetApp Clustered Data ONTAP 9.3P11 NetApp Clustered Data ONTAP 9.1P17 |
Discussion
NetApp Service Processor CVE-2019-5490 Arbitrary Command Execution Vulnerability
NetApp Service Processor is prone to an arbitrary command-execution vulnerability.
An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.
This issue affects the following products and versions:
NetApp Service Processor versions 2.8, 3.7, 4.5, and 5.5 running on Clustered Data ONTAP 9.5, 9.4 and 9.3
NetApp Service Processor versions 2.5, 3.4, 3.4 patch1, 3.4 patch2, 4.2, 5.2, 4.2 patch1, 4.2 patch2, 5.2, and 5.2 patch1 running on Clustered Data ONTAP 9.2
NetApp Service Processor versions 2.4.1, 2.4.1 patch1, 3.3, 3.3 patch1, 3.3 patch2, 3.3 patch3, 3.3 patch4, 4.1,4.1 patch1, 4.1 patch2, 4.1 patch3, 4.1 patch4, 4.1 patch4, 4.1 patch5, 4.1 patch6, 5.1, 5.1 patch1, 5.1 patch2, and 5.1 patch3 running on Clustered Data ONTAP 9.1
NetApp Service Processor versions 2.4 and 3.2 running on Clustered Data ONTAP 9.0
NetApp Service Processor versions 2.3.2, 2.3.2 patch1, 2.3.2 patch2, 2.3.2 patch3, 3.1.2, 3.1.2 patch1, and 3.1.2 patch2 running on Clustered Data ONTAP 8.3
NetApp Service Processor versions 2.5, and 3.0.4 running on Clustered Data ONTAP 8.2
NetApp Service Processor is prone to an arbitrary command-execution vulnerability.
An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.
This issue affects the following products and versions:
NetApp Service Processor versions 2.8, 3.7, 4.5, and 5.5 running on Clustered Data ONTAP 9.5, 9.4 and 9.3
NetApp Service Processor versions 2.5, 3.4, 3.4 patch1, 3.4 patch2, 4.2, 5.2, 4.2 patch1, 4.2 patch2, 5.2, and 5.2 patch1 running on Clustered Data ONTAP 9.2
NetApp Service Processor versions 2.4.1, 2.4.1 patch1, 3.3, 3.3 patch1, 3.3 patch2, 3.3 patch3, 3.3 patch4, 4.1,4.1 patch1, 4.1 patch2, 4.1 patch3, 4.1 patch4, 4.1 patch4, 4.1 patch5, 4.1 patch6, 5.1, 5.1 patch1, 5.1 patch2, and 5.1 patch3 running on Clustered Data ONTAP 9.1
NetApp Service Processor versions 2.4 and 3.2 running on Clustered Data ONTAP 9.0
NetApp Service Processor versions 2.3.2, 2.3.2 patch1, 2.3.2 patch2, 2.3.2 patch3, 3.1.2, 3.1.2 patch1, and 3.1.2 patch2 running on Clustered Data ONTAP 8.3
NetApp Service Processor versions 2.5, and 3.0.4 running on Clustered Data ONTAP 8.2
Solution / Fix
NetApp Service Processor CVE-2019-5490 Arbitrary Command Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.