PT-2014-6030 · Emc · Emc Avamar

Published 2014-10-25 · Updated 2017-08-29 · CVE-2014-4623

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EMC Avamar versions 6.0.x through 7.0.x

Description The issue allows context-dependent attackers to obtain cleartext passwords via a brute-force attack because UNIX DES crypt is used for password hashing when Password Hardening before version 2.0.0.4 is enabled.

Recommendations For versions 6.0.x through 7.0.x, update Password Hardening to version 2.0.0.4 or later to address the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-4623

Affected Products

Emc Avamar

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-4623 · Security Note
• http://securityfocus.com/bid/70732 · Note
• http://securitytracker.com/id/1031117 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97757 · Note
• http://packetstormsecurity.com/files/128842/EMC-Avamar-Weak-Password-Storage.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2014-10/0146.html · Note