{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-03-31T00:00:00", "descriptions": [{"lang": "en", "value": "EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-04-17T01:57:01", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"name": "20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html"}, {"tags": ["x_refsource_MISC"], "url": "https://gist.github.com/brandonprry/9895721"}, {"name": "20140331 EMC CTA v10.0 unauthenticated XXE with root perms", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2014/Mar/426"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security_alert@emc.com", "ID": "CVE-2014-0645", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20140416 ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html"}, {"name": "https://gist.github.com/brandonprry/9895721", "refsource": "MISC", "url": "https://gist.github.com/brandonprry/9895721"}, {"name": "20140331 EMC CTA v10.0 unauthenticated XXE with root perms", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2014/Mar/426"}]}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2014-0645", "datePublished": "2014-04-17T01:00:00", "dateReserved": "2014-01-02T00:00:00", "dateUpdated": "2014-04-17T01:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:emc:cloud_tiering_appliance_software:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DBC97A0E-D9FB-41D8-B9B0-476E9603CD8A", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:-:*:*:*:*:*:*", "matchCriteriaId": "487F9218-321C-460C-9BDE-D52EB35CE445", "vulnerable": true}, {"criteria": "cpe:2.3:a:emc:cloud_tiering_appliance_software:10.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "27ED383B-FA3D-40C6-92D6-6F116F3848C4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:emc:cloud_tiering_appliance:-:*:*:*:*:*:*:*", "matchCriteriaId": "106228B2-5481-4806-BBEE-AF2F083DB41D", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:emc:file_management_appliance_software:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "B3D8065F-B362-4B9B-83ED-CEBA04D75384", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:emc:file_management_appliance:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C888E2C-12BE-43F0-B5DB-54AC71E5A857", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "EMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x store DES password hashes for the root, super, and admin accounts, which makes it easier for context-dependent attackers to obtain sensitive information via a brute-force attack."}, {"lang": "es", "value": "EMC Cloud Tiering Appliance (CTA) 9.x hasta 10 SP1 y File Management Appliance (FMA) 7.x almacene hashes de contrase\u00f1as DES para las cuentas root, super, y de administraci\u00f3n, lo que facilita a atacantes dependientes de contexto obtener informaci\u00f3n sensible a trav\u00e9s de un ataque de fuerza bruta."}], "id": "CVE-2014-0645", "lastModified": "2014-04-17T15:10:45.367", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.7, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-04-17T01:55:05.690", "references": [{"source": "security_alert@emc.com", "url": "http://archives.neohapsis.com/archives/bugtraq/2014-04/0094.html"}, {"source": "security_alert@emc.com", "url": "http://seclists.org/fulldisclosure/2014/Mar/426"}, {"source": "security_alert@emc.com", "url": "https://gist.github.com/brandonprry/9895721"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}