PT-2016-4471 · Emc · Vnx1 File Oe+4

Published 2016-09-21 · Updated 2017-07-30 · CVE-2016-0917

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EMC VNXe3200 Operating Environment versions prior to 3.1.5.8711957 EMC VNXe3100/3150/3300 Operating Environment versions prior to 2.4.4.22638 VNX1 File OE versions prior to 7.1.80.3 VNX2 File OE versions prior to 8.1.9.155 Celerra (all supported versions)

Description The SMB service does not prevent duplicate NTLM challenge-response nonces, making it easier for remote attackers to execute arbitrary code, or read or write to files, via a series of authentication requests.

Recommendations For EMC VNXe3200 Operating Environment versions prior to 3.1.5.8711957, update to version 3.1.5.8711957 or later. For EMC VNXe3100/3150/3300 Operating Environment versions prior to 2.4.4.22638, update to version 2.4.4.22638 or later. For VNX1 File OE versions prior to 7.1.80.3, update to version 7.1.80.3 or later. For VNX2 File OE versions prior to 8.1.9.155, update to version 8.1.9.155 or later. For Celerra, contact the vendor for a fix, as all supported versions are affected.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-0917

Affected Products

Celerra

Emc Vnxe3100/3150/3300 Operating Environment

Emc Vnxe3200 Operating Environment

Vnx1 File Oe

Vnx2 File Oe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-0917 · Security Note
• http://securityfocus.com/bid/93023 · Note
• http://seclists.org/bugtraq/2016/Sep/32 · Note
• http://securityfocus.com/archive/1/539993/30/0/threaded · Note
• http://securitytracker.com/id/1036843 · Note