ESA-2016-167: EMC Documentum D2 Multiple Vulnerabilities

[EMC Product Security Response Center <Security_Alert@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ESA-2016-167: EMC Documentum D2 Multiple Vulnerabilities

EMC Identifier: ESA-2016-167 

CVE Identifier: CVE-2016-9872, CVE-2016-9873
 
Severity Rating: CVSS v3 Base Score: See below for CVSSv3 score.

Affected products:
EMC Documentum D2 version 4.5
EMC Documentum D2 version 4.6

Summary: 
EMC Documentum D2 contains fixes for multiple security vulnerabilities that 
could potentially be exploited by malicious users to compromise the affected 
system.

Details: 
EMC Documentum D2 is affected by the below vulnerabilities: 
Reflected Cross-Site Scripting Vulnerabilities (CVE-2016-9872)
EMC Documentum D2 is affected by multiple reflected cross-site scripting 
vulnerabilities. Attackers could potentially exploit these vulnerabilities to 
execute arbitrary HTML or JavaScript code in the user?s browser session in the 
context of the affected Documentum D2 application.
CVSS v3 Base Score: 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)

DQL Injection Vulnerability (CVE-2016-9873)
EMC Documentum D2 is affected by a DQL injection vulnerability. An 
authenticated low-privileged attacker could potentially exploit this 
vulnerability to access information, modify data or disrupt services by causing 
execution of arbitrary DQL commands on the application.
CVSS v3 Base Score: 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) 

Resolution: 
The following EMC Documentum D2 releases contain resolutions to these 
vulnerabilities: 
EMC Documentum D2 versions 4.5 P20 and later (CVE-2016-9872 only)
EMC Documentum D2 version 4.6 P08 and later (CVE-2016-9872 only)
EMC Documentum D2 version 4.7
  
EMC recommends all customers upgrade at the earliest opportunity. 
  

Link to remedies:
Customers can download software from:  
https://support.emc.com/downloads/24306_Documentum-D2 


Read and use the information in this EMC Security Advisory to assist in 
avoiding any situation that might arise from the problems described herein. If 
you have any questions regarding this product alert, contact EMC Software 
Technical Support at 1-877-534-2867.

For an explanation of Severity Ratings, refer to EMC Knowledgebase solution 
emc218831. EMC recommends all customers take into account both the base score 
and any relevant temporal and environmental scores which may impact the 
potential severity associated with particular security vulnerability.

EMC recommends that all users determine the applicability of this information 
to their individual situations and take appropriate action. The information set 
forth herein is provided "as is" without warranty of any kind. EMC disclaims 
all warranties, either express or implied, including the warranties of 
merchantability, fitness for a particular purpose, title and non-infringement. 
In no event, shall EMC or its suppliers, be liable for any damages whatsoever 
including direct, indirect, incidental, consequential, loss of business profits 
or special damages, even if EMC or its suppliers have been advised of the 
possibility of such damages. Some states do not allow the exclusion or 
limitation of liability for consequential or incidental damages, so the 
foregoing limitation may not apply.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYiiHPAAoJEHbcu+fsE81Z+H4H/3Tk8vTkWeMd9trxb7Uw9d2n
Y8/Motuk7sL2ZQoW85vyUP0mIix/8I27+WLsmKWek/d7BvH3Ct412BN41gBbXPHL
2zXnjb/wHF1uP6QIx+a+xVTP5lOiQsRiY6TGc3VdOp6xL/1hCJaPicJ5o70ugljD
GJLWEUGdYMZfYNpdD+5RjkxfeDWCg4txKjEE5TXAvIkutNR8+q32Zelwa9lf97Yh
Pv9bSJUhqzyLfAGbmFC/f0Y49ZLvpENep9RIOMR4DgRCdlEd59+5nVvWwC047UkM
Y0hQ2HLS3PmkcdgvGI3qR6+7lv7AZxyP4+p/GS9oBgYJ4ewmgqOLJn+GieB52eI=
=W+Gm
-----END PGP SIGNATURE-----