ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities

ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities

EMC Identifier: ESA-2015-131

CVE Identifier:  CVE-2015-4531, CVE-2015-4532, CVE-2015-4533, CVE-2015-4534, CVE-2015-4535, CVE-2015-4536

Severity Rating: CVSS v2 Base Score: See below for individual scores for each CVE

Affected products: 

• EMC Documentum Content Server prior to 7.0
• EMC Documentum Content Server 7.0
• EMC Documentum Content Server 7.1
• EMC Documentum Content Server 7.2

Summary: 

EMC Documentum Content Server contains multiple vulnerabilities that could be exploited by malicious users to compromise the Content Server in several ways.

Details: 

EMC Documentum Content Server is susceptible to the following vulnerabilities:

1. Authenticated Content Server users with sysadmin privileges may potentially escalate their privileges to become a super-user due to improper authorization checks  performed on subgroups that exists within the dm_superusers group and other privileged groups. This may potentially be exploited by a malicious attacker to gain unauthorized access to data or to perform unauthorized actions on Content Server. The previous fix for CVE-2014-4622 was incomplete.

CVE ID: CVE-2015-4531

CVSS v2 Base Score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)

2. Authenticated non-privileged Content Server users are allowed to run save RPC commands with super user privileges on arbitrary objects. This is due to improper user authorization checks and object type checks being performed on these objects. This may potentially be exploited by a malicious, authenticated non-privileged user to perform unauthorized actions on Content Server including executing arbitrary code. The previous fix for CVE-2014-2514 was incomplete.

CVE ID: CVE-2015-4532

CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:C/I:C/A:P)

3. Authenticated non-privileged Content Server users are allowed to execute arbitrary code with super user privileges via custom scripts. This is due to improper authorization checks being performed on the objects created. This may potentially be exploited to perform unauthorized actions on Content Server. The previous fix for CVE-2014-2513 was incomplete. 

CVE ID: CVE-2015-4533 

CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:C/I:C/A:P)

4. Content Server delegates execution of business logic to an embedded java application server called "Java Method Server" (JMS). JMS fails to properly validate digital signatures, leading to the possibility of arbitrary code execution on the Content Server. An attacker capable of crafting a digital signature for a query string without the method_verb parameter may be able to execute arbitrary code in Content Server in JMS context, depending on Java classes present in the classloader. 

CVE ID: CVE-2015-4534
CVSS v2 Base Score: 8.2 (AV:N/AC:M/Au:S/C:P/I:C/A:C)


5. Content Server delegates execution of business logic to an embedded java application server called "Java Method Server" (JMS). JMS logs login tickets in certain instances when the __debug_trace__ parameter is enabled. An attacker with access to or capable of hijacking Content Server logs may be able to obtain superuser tickets and privileges. 

CVE ID: CVE-2015-4535

CVSS v2 Base Score: 7.5 (AV:N/AC:M/Au:S/C:P/I:P/A:C)

6. When RPC tracing is enabled, obfuscated passwords of Content Server users with inline password authentication are posted to the log file in clear text. An attacker with access to Content Server log files can use the passwords to log-in as the compromised user.

CVE ID: CVE-2015-4536
CVSS v2 Base Score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)

Resolution: 

The following versions contain the fixes for vulnerabilities described in CVE-2015-4531, CVE-2015-4532, CVE-2015-4533, CVE-2015-4534, CVE-2015-4535 
• EMC Documentum Content Server 6.7SP1P32 or later
• EMC Documentum Content Server 6.7SP2P25 or later
• EMC Documentum Content Server 7.0P19 or later
• EMC Documentum Content Server 7.1P16 or later
• EMC Documentum Content Server 7.2P02 or later

The following versions contain the fix for the vulnerability described in CVE-2015-4536
• EMC Documentum Content Server 7.0P20 or later
• EMC Documentum Content Server 7.1P18 or later
• EMC Documentum Content Server 7.2P02 or later

EMC strongly recommends all customers to apply the patches at the earliest opportunity.
Link to remedies:

Registered EMC Online support customers can download software from https://emc.subscribenet.com/.

Read and use the information in this EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact EMC Software Technical Support at 1-877-534-2867.

For an explanation of Severity Ratings, refer to EMC Knowledgebase solution emc218831. EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.

EMC Corporation distributes EMC Security Advisories, in order to bring to the attention of users of the affected EMC products, important security information. EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.


EMC Product Security Response Center
security_alert@emc.com