PT-2014-3740 · Emc · Emc File Management Appliance+1

Brandon Perry · Published 2014-04-17 · Updated 2014-04-17 · CVE-2014-0645

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC Cloud Tiering Appliance (CTA) versions 9.x through 10 SP1 EMC File Management Appliance (FMA) versions 7.x

Description The issue allows context-dependent attackers to obtain sensitive information via a brute-force attack because DES password hashes are stored for the root, super, and admin accounts.

Recommendations For EMC Cloud Tiering Appliance (CTA) versions 9.x through 10 SP1, consider changing the password hashing algorithm to a more secure one to mitigate the risk of brute-force attacks. For EMC File Management Appliance (FMA) versions 7.x, consider changing the password hashing algorithm to a more secure one to mitigate the risk of brute-force attacks.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-0645

Affected Products

Emc Cloud Tiering Appliance

Emc File Management Appliance

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-0645 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html · Note
• http://seclists.org/fulldisclosure/2014/Mar/426 · Note
• https://gist.github.com/brandonprry/9895721 · Note