Hitachi Device Manager CVE-2017-9294 Arbitrary Command Execution Vulnerability

Bugtraq ID:	98765
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 29 2017 12:00AM
Updated:	May 29 2017 12:00AM
Credit:	Piotr Domirski (ING Services Polska), Marcin Woloszyn (ING Services Polska), Pawel Bartunek (ING Services Polska), Pawel Gocyla (ING Services Polska).
Vulnerable:	Hitachi Tuning Manager 8.0.0-00 Hitachi Tiered Storage Manager 8.1.1 Hitachi Tiered Storage Manager 6.2 Hitachi Replication Manager 8.4.1-02 Hitachi Replication Manager 8.1.1 Hitachi Replication Manager 8.0.0-00 Hitachi Global Link Manager 8.1.1 Hitachi Device Manager 8.4.1-02 Hitachi Device Manager 8.1.1 Hitachi Device Manager 8.0.0-00 Hitachi Compute Systems Manager 8.1.1 Hitachi Compute Systems Manager 8.1.0 Hitachi Compute Systems Manager 8.0.0 Hitachi Compute Systems Manager 7.6.1
Not Vulnerable:	Hitachi Tuning Manager 8.5.2-00 Hitachi Tiered Storage Manager 8.5.2-01 Hitachi Replication Manager 8.5.2-00 Hitachi Global Link Manager 8.5.2-00 Hitachi Device Manager 8.5.2-01 Hitachi Compute Systems Manager 8.5.2-00

Hitachi Device Manager CVE-2017-9294 Arbitrary Command Execution Vulnerability

Hitachi Device Manager is prone to a remote arbitrary command-execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.

Versions of Hitachi Device Manager prior to 8.5.2-01 are vulnerable.

Hitachi Device Manager CVE-2017-9294 Arbitrary Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Hitachi Device Manager CVE-2017-9294 Arbitrary Command Execution Vulnerability

References:

• Hitachi Device Manager Homepage ( Hitachi)
  
• Hitachi Homepage (Hitachi)
  
• Multiple Vulnerabilities in Hitachi Command Suite (hitachi)