Execution with unnecessary privileges in EMC Virtual Appliances - CVE-2021-36339

Vulnerability identifier: #VU69272

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-36339

CWE-ID: CWE-250

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application binary has a setuid bit. A local low-privileged user can run the affected binary to get privileged access to the virtual appliance.

EMC Virtual Appliances
Solutions Enabler
Unisphere 360
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
VASA Provider Standalone
Solutions Enabler Virtual Appliance

Install updates from vendor's website.

EMC Virtual Appliances - update to 9.2.2.2
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.19, 9.2.3.1
Solutions Enabler - addressed in versions 9.1.0.19, 9.2.3.1
Unisphere 360 - addressed in versions 9.1.0.30, 9.2.3.4
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.32, 9.2.3.11
Unisphere for PowerMax - addressed in versions 9.1.0.32, 9.2.3.11
VASA Provider Standalone - addressed in versions 9.1.0.724, 9.2.3.10

• https://www.dell.com/support/kbdoc/000194640

• Multiple vulnerabilities in Dell Unisphere for PowerMax, Dell Solutions Enabler, Dell Unisphere 360 and Dell VASA Provider