Emerson Network Power Avocent MergePoint Unity 2016 KVM目录

发布日期：2014-01-23
更新日期：2014-01-27

受影响系统：
emersonnetworkpower Avocent MergePoint Unity 1.9.16473
描述：
--------------------------------------------------------------------------------
BUGTRAQ  ID: 65105
CVE(CAN) ID: CVE-2013-6030

MergePoint Unity交换机是下一代KVM，可以远程管理数据中心和分支机构。

Emerson Network Power Avocent MergePoint Unity 2016 KVM（固件版本1.9.16473）在实现上存在目录遍历漏洞，可使远程攻击者下载关键文件，例如/etc/passwd，读取任意文件，获取设备的凭证。

<*来源：Shady Liu
 
  链接：http://www.kb.cert.org/vuls/id/168751
*>

建议：
--------------------------------------------------------------------------------
临时解决方法：

限制访问MPU2016 KVM交换机Web接口。

厂商补丁：

emersonnetworkpower
-------------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.emersonnetworkpower.com/en-US/Products/InfrastructureManagement/DigitalKVMAppliances/Page

参考:

http://www.emersonnetworkpower.com/en-US/Products/InfrastructureManagement/DigitalKVMAppliances/Pages/AvocentMergePointUnityAppliances.aspx
http://www.avocent.com/Support_Firmware/MergePoint_Unity/MergePoint_Unity_Switch.aspx
http://cwe.mitre.org/data/definitions/23.html
http://www.avocent.com/Support_Firmware/MergePoint_Unity/MergePoint_Unity_Switch_-_Previous_Releases.aspx