Description
The SAN Manager Master Agent service (aka msragent.exe) in EMC Control Center before 6.1 does not properly authenticate SST_SENDFILE requests, which allows remote attackers to read arbitrary files.
References
- http://www.zerodayinitiative.com/advisories/ZDI-08-076/
- 32392 vdb-entry
- controlcenter-msragent-file-download(46753) vdb-entry
- 32801 third-party-advisory
- ADV-2008-3220 vdb-entry
- 1021263 vdb-entry
- 50032 vdb-entry
- 4709 third-party-advisory
- 20081120 ZDI-08-076: EMC Control Center SAN Manager SST_SENDFILE Remote File Retrieval Vulnerability mailing-list