EMC Documentum eRoom Arbitrary File Upload Vulnerability

Bugtraq ID:	50509
Class:	Input Validation Error
CVE:	CVE-2011-2739
Remote:	Yes
Local:	No
Published:	Nov 03 2011 12:00AM
Updated:	Nov 03 2011 12:00AM
Credit:	EMC
Vulnerable:	EMC Documentum eRoom 7.4.2 EMC Documentum eRoom 7.4.1 EMC Documentum eRoom 7.4.3.f EMC Documentum eRoom 7.4.3.f EMC Documentum eRoom 7.4.3 EMC Documentum eRoom 7.4.3 EMC Documentum eRoom 7.3
Not Vulnerable:	EMC Documentum eRoom 7.4.3g

EMC Documentum eRoom Arbitrary File Upload Vulnerability

EMC Documentum eRoom is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to properly restrict access to certain functionality.

An attacker can exploit this vulnerability to upload arbitrary files and execute arbitrary code with administrative privileges. Successful exploits will result in the complete compromise of affected computers.

EMC Documentum eRoom Arbitrary File Upload Vulnerability

Attackers can exploit this issue using a browser or readily available tools.

EMC Documentum eRoom Arbitrary File Upload Vulnerability

Solution:
Vendor updates are available. Please see the referenced advisories for more information.

EMC Documentum eRoom Arbitrary File Upload Vulnerability

References:

• EMC Documentum eRoom Homepage (EMC)
  
• ESA-2011-032: EMC Documentum eRoom arbitrary file upload vulnerability. ([email protected])