PT-2014-3740 · Emc · Emc File Management Appliance+1

Brandon Perry · Publicado 2014-04-17 · Atualizado 2014-04-17 · CVE-2014-0645

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC Cloud Tiering Appliance (CTA) versions 9.x through 10 SP1 EMC File Management Appliance (FMA) versions 7.x

Description The issue allows context-dependent attackers to obtain sensitive information via a brute-force attack because DES password hashes are stored for the root, super, and admin accounts.

Recommendations For EMC Cloud Tiering Appliance (CTA) versions 9.x through 10 SP1, consider changing the password hashing algorithm to a more secure one to mitigate the risk of brute-force attacks. For EMC File Management Appliance (FMA) versions 7.x, consider changing the password hashing algorithm to a more secure one to mitigate the risk of brute-force attacks.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2014-0645

Produtos afetados

Emc Cloud Tiering Appliance

Emc File Management Appliance

Referências · 4

• http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html · Nota
• http://seclists.org/fulldisclosure/2014/Mar/426 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0645 · Nota de Segurança
• https://gist.github.com/brandonprry/9895721 · Nota