PT-2016-1645 · Netapp · Netapp Clustered Data Ontap

Published 2016-04-07 · Updated 2017-11-16 · CVE-2016-1563

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NetApp Clustered Data ONTAP version 8.3.1

Description The issue arises from the improper verification of X.509 certificates from TLS servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. This can enable a remote attacker to substitute servers or gain confidential information by using a specially formed certificate.

Recommendations For NetApp Clustered Data ONTAP version 8.3.1, consider updating the system to a version that properly verifies X.509 certificates from TLS servers to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive information and consider disabling TLS connections until a patch is available.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

BDU:2016-00957

CVE-2016-1563

Affected Products

Netapp Clustered Data Ontap

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-1563 · Security Note
• https://kb.netapp.com/support/index?page=content&id=9010064 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00957 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1563 · Vendor Advisory
• https://kb.netapp.com/support/index?page=content&id=9010064 · Note
• https://security.netapp.com/advisory/ntap-20160310-0002 · Note