RSA enVision Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	49317
Class:	Input Validation Error
CVE:	CVE-2011-2736 CVE-2011-2737
Remote:	Yes
Local:	No
Published:	Aug 22 2011 12:00AM
Updated:	Aug 22 2011 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	Rsa enVision Platform 3.7 SP1 Rsa enVision Platform 3.7 Rsa enVision Platform 3.5.2 Rsa enVision Platform 3.5.1 Rsa enVision Platform 3.5 Rsa enVision Platform 4.0 Rsa enVision Platform 3.7 SP 1
Not Vulnerable:	Rsa enVision Platform 4 SP4 P3

RSA enVision Multiple Information Disclosure Vulnerabilities

RSA enVision is prone to multiple information-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to disclose administrative credentials or retrieve arbitrary files. Information obtained can aid in launching further attacks.

RSA enVision versions prior to 4 SP4 P3 are affected.

RSA enVision Multiple Information Disclosure Vulnerabilities

Attackers can use readily available tools to exploit these issues.

RSA enVision Multiple Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

RSA enVision Multiple Information Disclosure Vulnerabilities

References:

• enVision Homepage (RSA)
  
• ESA-2011-030: RSA, The Security Division of EMC, announces security fixes for RS (EMC)