CVE-2015-0525

The Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html	Third Party Advisory VDB Entry
http://seclists.org/bugtraq/2015/Mar/40	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2015/Mar/118	Mailing List Third Party Advisory
http://www.securityfocus.com/archive/1/534928/100/0/threaded	Third Party Advisory VDB Entry
https://www.securify.nl/advisory/SFY20141112/command_injection_vulnerability_in_emc_secure_remote_services_virtual_edition.html	Exploit
http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html	Third Party Advisory VDB Entry
http://seclists.org/bugtraq/2015/Mar/40	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2015/Mar/118	Mailing List Third Party Advisory
http://www.securityfocus.com/archive/1/534928/100/0/threaded	Third Party Advisory VDB Entry
https://www.securify.nl/advisory/SFY20141112/command_injection_vulnerability_in_emc_secure_remote_services_virtual_edition.html	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:emc:secure_remote_services:3.02::::virtual:::
	cpe:2.3:a:emc:secure_remote_services:3.03::::virtual:::

History

No history.

Information

Published : 2015-03-12 10:59

Updated : 2025-04-12 10:46

NVD link : CVE-2015-0525

Mitre link : CVE-2015-0525

CVE.ORG link : CVE-2015-0525

JSON object : View

Products Affected

emc

secure_remote_services

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2015-0525", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-03-12T10:59:04.583", "references": [{"url": "http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "http://seclists.org/bugtraq/2015/Mar/40", "tags": ["Mailing List", "Third Party Advisory"], "source": "security_alert@emc.com"}, {"url": "http://seclists.org/fulldisclosure/2015/Mar/118", "tags": ["Mailing List", "Third Party Advisory"], "source": "security_alert@emc.com"}, {"url": "http://www.securityfocus.com/archive/1/534928/100/0/threaded", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "https://www.securify.nl/advisory/SFY20141112/command_injection_vulnerability_in_emc_secure_remote_services_virtual_edition.html", "tags": ["Exploit"], "source": "security_alert@emc.com"}, {"url": "http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/bugtraq/2015/Mar/40", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2015/Mar/118", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/534928/100/0/threaded", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.securify.nl/advisory/SFY20141112/command_injection_vulnerability_in_emc_secure_remote_services_virtual_edition.html", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary OS commands via unspecified vectors."}, {"lang": "es", "value": "El servicio Gateway Provisioning en EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 y 3.03 permite a atacantes remotos ejecutar comandos del sistema operativo arbitrarios a trav\u00e9s de vectores no especificados."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emc:secure_remote_services:3.02:*:*:*:virtual:*:*:*", "vulnerable": true, "matchCriteriaId": "01FFD337-155A-403F-9270-09A0DF8D4161"}, {"criteria": "cpe:2.3:a:emc:secure_remote_services:3.03:*:*:*:virtual:*:*:*", "vulnerable": true, "matchCriteriaId": "0C9FDED1-65A7-44D3-A345-392F0B8C6D27"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}