PT-2016-1645 · Netapp · Netapp Clustered Data Ontap

Publicado 2016-04-07 · Atualizado 2017-11-16 · CVE-2016-1563

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NetApp Clustered Data ONTAP version 8.3.1

Description The issue arises from the improper verification of X.509 certificates from TLS servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. This can enable a remote attacker to substitute servers or gain confidential information by using a specially formed certificate.

Recommendations For NetApp Clustered Data ONTAP version 8.3.1, consider updating the system to a version that properly verifies X.509 certificates from TLS servers to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive information and consider disabling TLS connections until a patch is available.

Correção

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-20

CWE-200

Identificadores relacionados

BDU:2016-00957

CVE-2016-1563

Produtos afetados

Netapp Clustered Data Ontap

Referências · 6

• https://kb.netapp.com/support/index?page=content&id=9010064 · Nota
• https://security.netapp.com/advisory/ntap-20160310-0002 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1563 · Nota de Segurança
• https://kb.netapp.com/support/index?page=content&id=9010064 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00957 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1563 · Aviso do Fabricante