Intersystems Cache Default 'Minimal Security' Install Remote Code Execution Vulnerability

Bugtraq ID:	63803
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2013 12:00AM
Updated:	Nov 18 2013 12:00AM
Credit:	Mike Arnold
Vulnerable:	InterSystems Cache 2013.1.1 InterSystems Cache 2013.1 InterSystems Cache 2012.1.5 InterSystems Cache 2012.1.4 InterSystems Cache 2011.1.6 InterSystems Cache 2011.1.5 InterSystems Cache 2007.1.1 .420.0 InterSystems Cache 2007.1 .369.0 InterSystems Cache 2009.1.3 InterSystems Cache 2009.1.2 InterSystems Cache 2009.1.1 InterSystems Cache 2009.1 InterSystems Cache 2007.1
Not Vulnerable:

Intersystems Cache Default 'Minimal Security' Install Remote Code Execution Vulnerability

Intersystems Cache is prone to a remote code-execution vulnerability.

Successful exploits will allow attackers to execute arbitrary code within the context of the application.

Intersystems Cache Default 'Minimal Security' Install Remote Code Execution Vulnerability

The researcher of this issue has created a proof-of-concept. Please see the references for more information.

The following exploit is available:

• /data/vulnerabilities/exploits/63803.rb

Intersystems Cache Default 'Minimal Security' Install Remote Code Execution Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Intersystems Cache Default 'Minimal Security' Install Remote Code Execution Vulnerability

References:

• InterSystems Caché: Post-relational Database Homepage (InterSystems)
  
• Intersystems Cache Remote Code Execution (via Default Minimal Security Install) (SecLists.Org)
  
• July 31, 2013 �?? InterSystems Security Notification (InterSystems)