ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities

[Security Alert <Security_Alert@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities

EMC Identifier: ESA-2015-131

CVE Identifier:  CVE-2015-4531, CVE-2015-4532, CVE-2015-4533, CVE-2015-4534, 
CVE-2015-4535, CVE-2015-4536

Severity Rating: CVSS v2 Base Score: See below for individual scores for each 
CVE

Affected products: 

?       EMC Documentum Content Server prior to 7.0
?       EMC Documentum Content Server 7.0
?       EMC Documentum Content Server 7.1
?       EMC Documentum Content Server 7.2

Summary: 

EMC Documentum Content Server contains multiple vulnerabilities that could be 
exploited by malicious users to compromise the Content Server in several ways.

Details: 

EMC Documentum Content Server is susceptible to the following vulnerabilities:

1.      Authenticated Content Server users with sysadmin privileges may 
potentially escalate their privileges to become a super-user due to improper 
authorization checks  performed on subgroups that exists within the 
dm_superusers group and other privileged groups. This may potentially be 
exploited by a malicious attacker to gain unauthorized access to data or to 
perform unauthorized actions on Content Server. The previous fix for 
CVE-2014-4622 was incomplete.

CVE ID: CVE-2015-4531

CVSS v2 Base Score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)

2.      Authenticated non-privileged Content Server users are allowed to run 
save RPC commands with super user privileges on arbitrary objects. This is due 
to improper user authorization checks and object type checks being performed on 
these objects. This may potentially be exploited by a malicious, authenticated 
non-privileged user to perform unauthorized actions on Content Server including 
executing arbitrary code. The previous fix for CVE-2014-2514 was incomplete.

CVE ID: CVE-2015-4532

CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:C/I:C/A:P)

3.      Authenticated non-privileged Content Server users are allowed to 
execute arbitrary code with super user privileges via custom scripts. This is 
due to improper authorization checks being performed on the objects created. 
This may potentially be exploited to perform unauthorized actions on Content 
Server. The previous fix for CVE-2014-2513 was incomplete. 

CVE ID: CVE-2015-4533 

CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:C/I:C/A:P)

4.      Content Server delegates execution of business logic to an embedded 
java application server called "Java Method Server" (JMS). JMS fails to 
properly validate digital signatures, leading to the possibility of arbitrary 
code execution on the Content Server. An attacker capable of crafting a digital 
signature for a query string without the method_verb parameter may be able to 
execute arbitrary code in Content Server in JMS context, depending on Java 
classes present in the classloader. 

CVE ID: CVE-2015-4534
CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:P/I:C/A:C)


5.      Content Server delegates execution of business logic to an embedded 
java application server called "Java Method Server" (JMS). JMS logs login 
tickets in certain instances when the __debug_trace__ parameter is enabled. An 
attacker with access to or capable of hijacking Content Server logs may be able 
to obtain superuser tickets and privileges. 

CVE ID: CVE-2015-4535

CVSS v2 Base Score: 7.5 (AV:N/AC:M/Au:S/C:P/I:P/A:C)

6.      When RPC tracing is enabled, obfuscated passwords of Content Server 
users with inline password authentication are posted to the log file in clear 
text. An attacker with access to Content Server log files can use the passwords 
to log-in as the compromised user.

CVE ID: CVE-2015-4536
CVSS v2 Base Score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)

Resolution: 

The following versions contain the fixes for vulnerabilities described in 
CVE-2015-4531, CVE-2015-4532, CVE-2015-4533, CVE-2015-4534, CVE-2015-4535 
?       EMC Documentum Content Server 6.7SP1P32 or later
?       EMC Documentum Content Server 6.7SP2P25 or later
?       EMC Documentum Content Server 7.0P19 or later
?       EMC Documentum Content Server 7.1P16 or later
?       EMC Documentum Content Server 7.2P02 or later

The following versions contain the fix for the vulnerability described in 
CVE-2015-4536
?       EMC Documentum Content Server 7.0P20 or later
?       EMC Documentum Content Server 7.1P18 or later
?       EMC Documentum Content Server 7.2P02 or later

EMC strongly recommends all customers to apply the patches at the earliest 
opportunity.
Link to remedies:

Registered EMC Online support customers can download software from 
https://emc.subscribenet.com/.

Read and use the information in this EMC Security Advisory to assist in 
avoiding any situation that might arise from the problems described herein. If 
you have any questions regarding this product alert, contact EMC Software 
Technical Support at 1-877-534-2867.

For an explanation of Severity Ratings, refer to EMC Knowledgebase solution 
emc218831. EMC recommends all customers take into account both the base score 
and any relevant temporal and environmental scores which may impact the 
potential severity associated with particular security vulnerability.

EMC Corporation distributes EMC Security Advisories, in order to bring to the 
attention of users of the affected EMC products, important security 
information. EMC recommends that all users determine the applicability of this 
information to their individual situations and take appropriate action. The 
information set forth herein is provided "as is" without warranty of any kind. 
EMC disclaims all warranties, either express or implied, including the 
warranties of merchantability, fitness for a particular purpose, title and 
non-infringement. In no event, shall EMC or its suppliers, be liable for any 
damages whatsoever including direct, indirect, incidental, consequential, loss 
of business profits or special damages, even if EMC or its suppliers have been 
advised of the possibility of such damages. Some states do not allow the 
exclusion or limitation of liability for consequential or incidental damages, 
so the foregoing limitation may not apply.


EMC Product Security Response Center
security_alert@xxxxxxx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Cygwin)

iEYEARECAAYFAlXR2/MACgkQtjd2rKp+ALyjggCcCHtFP+E8efdEpb3L3AbR4pWz
7DQAn3Om9XRWTq8PLNFiCl61ZC8gDHrr
=F2Hc
-----END PGP SIGNATURE-----