PT-2017-13433 · Emc · Emc Data Domain Os+1

Published 2017-12-20 · Updated 2018-01-12 · CVE-2017-14385

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EMC Data Domain DD OS versions prior to 5.7.5.6 EMC Data Domain DD OS versions prior to 6.0.2.9 EMC Data Domain DD OS versions prior to 6.1.0.21 EMC Data Domain Virtual Edition 2.0 family, all versions EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1 EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2

Description A memory overflow issue exists in the SMBv1 component of EMC Data Domain DD OS, potentially allowing an unauthenticated remote attacker to exploit it. This could lead to a complete shutdown of both the SMB service and active directory authentication, and may also enable remote code injection and execution.

Recommendations For EMC Data Domain DD OS versions prior to 5.7.5.6, update to version 5.7.5.6 or later. For EMC Data Domain DD OS versions prior to 6.0.2.9, update to version 6.0.2.9 or later. For EMC Data Domain DD OS versions prior to 6.1.0.21, update to version 6.1.0.21 or later. For EMC Data Domain Virtual Edition 2.0 family, consider upgrading to a newer version. For EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1, update to 3.0 SP2 Update 1 or later. For EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2, update to 3.1 Update 2 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-14385

Affected Products

Emc Data Domain Os

Emc Data Domain Virtual Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-14385 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14385 · Vendor Advisory
• http://securityfocus.com/bid/102289 · Note
• http://securitytracker.com/id/1040027 · Note
• http://seclists.org/fulldisclosure/2017/Dec/79 · Note