vendor:
Enterprise Backup
by:
Cale Smith, Benny Husted, Jared Arave
9.8
CVSS
CRITICAL
Remote Code Execution
78
CWE
Product Name: Enterprise Backup
Affected Version From: 10.0.0
Affected Version To: 10.0.0-5.201708151911.CentOS6
Patch Exists: YES
Related CWE: CVE-2018-6328, CVE-2018-6329
CPE: a:unitrends:enterprise_backup:10.0.0
Other Scripts:
N/A
Platforms Tested: 10.0.0-2.201706252204.CentOS6, 10.0.0-5.201708151911.CentOS6
2017
Unauthenticated root RCE for Unitrends UEB 10.0
A sqli + low priv remote RCE vulnerability is used to establish a low priv remote shell from the UEB 10 host. A local privesc exploit containing the desired command is uploaded to the host using this shell, and executed. The initial low priv shell is closed, and the local privesc script is deleted.
Mitigation:
Ensure that the UEB 10 appliance is running the latest version of the software and that all security patches are applied.
