#VU758 Arbitrary code execution in Solutions Enabler Virtual Appliance and VMAX Virtual Appliance Manager - CVE-2016-6646

Vulnerability identifier: #VU758

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-6646

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Solutions Enabler Virtual Appliance
Server applications / Virtualization software
VMAX Virtual Appliance Manager
Server applications / Virtualization software

Vendor: Dell

Description
The vulnerability allows a remote user to cause arbitrary code execution on the target system.
The weakness is caused by insufficient input validation. By uploading specially crafted data to the GetSymmCmdRequest or RemoteServiceHandler class atackers can execute arbitary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Mitigation
Update to version 8.3.0.

Vulnerable software versions

Solutions Enabler Virtual Appliance: 8.0 - 8.2

VMAX Virtual Appliance Manager: 8.0 - 8.2

---

External links
https://seclists.org/bugtraq/2016/Oct/7

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.