EMC Secure Remote Services Virtual Edition CVE-2015-0525 Unspecified Command Injection Vulnerability

Bugtraq ID:	73025
Class:	Input Validation Error
CVE:	CVE-2015-0525
Remote:	Yes
Local:	No
Published:	Mar 11 2015 12:00AM
Updated:	Mar 11 2015 12:00AM
Credit:	Han Sahin of Securify B.V.
Vulnerable:	EMC EMC Secure Remote Services Virtual Edition 3.03 EMC EMC Secure Remote Services Virtual Edition 3.02
Not Vulnerable:	EMC EMC Secure Remote Services Virtual Edition 3.04

EMC Secure Remote Services Virtual Edition CVE-2015-0525 Unspecified Command Injection Vulnerability

EMC Secure Remote Services Virtual Edition is prone to an unspecified command-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary commands in context of the affected application.

The following products are vulnerable:

EMC Secure Remote Services Virtual Edition 3.02
EMC Secure Remote Services Virtual Edition 3.03

EMC Secure Remote Services Virtual Edition CVE-2015-0525 Unspecified Command Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

EMC Secure Remote Services Virtual Edition CVE-2015-0525 Unspecified Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

EMC Secure Remote Services Virtual Edition CVE-2015-0525 Unspecified Command Injection Vulnerability

References:

• EMC Homepage (EMC)
  
• ESA-2015-040: EMC Secure Remote Services Virtual Edition Security Update for Mul (Seclists.org)