Multiple EMC Avamar Products CVE-2013-3275 Multiple Frame Injection Vulnerabilities

Bugtraq ID:	61303
Class:	Input Validation Error
CVE:	CVE-2013-3275
Remote:	Yes
Local:	No
Published:	Jul 17 2013 12:00AM
Updated:	Jul 17 2013 12:00AM
Credit:	EMC
Vulnerable:	EMC Avamar Virtual Edition 6.1 EMC Avamar Virtual Edition 6.0 EMC Avamar Server 6.1.0 EMC Avamar Server 6.0 EMC Avamar Server 5.0
Not Vulnerable:	EMC Avamar Virtual Edition 7.0 EMC Avamar Server 7.0

Multiple EMC Avamar Products CVE-2013-3275 Multiple Frame Injection Vulnerabilities

Multiple EMC Avamar products are prone to multiple frame-injection vulnerabilities.

An attacker can exploit these issues to monitor legitimate web users activity and perform unauthorized actions.

The following products are vulnerable:

Versions prior to EMC Avamar Server 7.0
Versions prior to EMC Avamar Virtual Edition 7.0

Multiple EMC Avamar Products CVE-2013-3275 Multiple Frame Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

Multiple EMC Avamar Products CVE-2013-3275 Multiple Frame Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple EMC Avamar Products CVE-2013-3275 Multiple Frame Injection Vulnerabilities

References:

• Avamar Homepage (EMC)
  
• ESA-2013-055: EMC Avamar Multiple Vulnerabilities (EMC)