CVE-2014-0645

EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack.

CVSS v2.0 4.7 MEDIUM

4.7^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:C/I:N/A:N

Exploitability : 3.4 / Impact : 6.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://seclists.org/fulldisclosure/2014/Mar/426
http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html
https://gist.github.com/brandonprry/9895721

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:sp1::::::
	cpe:2.3:a:emc:cloud_tiering_appliance_software:9.0:::::::*
	cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:-::::::

cpe:2.3:h:emc:cloud_tiering_appliance:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:emc:file_management_appliance_software:7.0:*:*:*:*:*:*:*

cpe:2.3:h:emc:file_management_appliance:-:*:*:*:*:*:*:*

Information

Published : 2014-04-16 18:55

Updated : 2014-04-17 08:10

NVD link : CVE-2014-0645

Mitre link : CVE-2014-0645

JSON object : View

CWE

CWE-255

Credentials Management Errors

Products Affected

emc

file_management_appliance
file_management_appliance_software
cloud_tiering_appliance_software
cloud_tiering_appliance

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://seclists.org/fulldisclosure/2014/Mar/426", "name": "20140331 EMC CTA v10.0 unauthenticated XXE with root perms", "tags": [], "refsource": "FULLDISC"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html", "name": "20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://gist.github.com/brandonprry/9895721", "name": "https://gist.github.com/brandonprry/9895721", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-255"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-0645", "ASSIGNER": "secure@dell.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.7, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "severity": "MEDIUM", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-04-17T01:55Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:emc:cloud_tiering_appliance_software:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:emc:cloud_tiering_appliance:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:emc:file_management_appliance_software:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:emc:file_management_appliance:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2014-04-17T15:10Z"}

4.7 /10