EMC Data Protection Advisor CVE-2012-4616 Directory Traversal Vulnerability

Bugtraq ID:	57046
Class:	Input Validation Error
CVE:	CVE-2012-4616
Remote:	Yes
Local:	No
Published:	Dec 20 2012 12:00AM
Updated:	Dec 20 2012 12:00AM
Credit:	Andrea Micalizzi
Vulnerable:	EMC Data Protection Advisor 5.8 SP4 EMC Data Protection Advisor 5.8 SP3 EMC Data Protection Advisor 5.8 SP2 EMC Data Protection Advisor 5.8 SP1 EMC Data Protection Advisor 5.8 EMC Data Protection Advisor 5.7 SP1 EMC Data Protection Advisor 5.7 EMC Data Protection Advisor 5.6 SP1 EMC Data Protection Advisor 5.6
Not Vulnerable:

EMC Data Protection Advisor CVE-2012-4616 Directory Traversal Vulnerability

EMC Data Protection Advisor is prone to a directory-traversal vulnerability.

A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information.

The following versions are vulnerable:

EMC Data Protection Advisor 5.6
EMC Data Protection Advisor 5.6 SP1
EMC Data Protection Advisor 5.7
EMC Data Protection Advisor 5.7 SP1
EMC Data Protection Advisor 5.8
EMC Data Protection Advisor 5.8 SP1
EMC Data Protection Advisor 5.8 SP2
EMC Data Protection Advisor 5.8 SP3
EMC Data Protection Advisor 5.8 SP4

EMC Data Protection Advisor CVE-2012-4616 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references for more information.

EMC Data Protection Advisor CVE-2012-4616 Directory Traversal Vulnerability

References:

• EMC Data Protection Advisor Homepage (EMC)
  
• EMC Homepage (EMC)
  
• ESA-2012-060: EMC Data Protection Advisor Information Disclosure Vulnerability (EMC)