CVE-2014-4623
Summary
| CVE | CVE-2014-4623 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-10-25 10:55:00 UTC |
| Updated | 2017-08-29 01:35:00 UTC |
| Description | EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack. |
Risk And Classification
Problem Types: CWE-310
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Emc | Avamar | 6.0.1 | All | All | All |
| Application | Emc | Avamar | 6.0.2 | All | All | All |
| Application | Emc | Avamar | 6.0.3 | All | All | All |
| Application | Emc | Avamar | 6.1 | All | All | All |
| Application | Emc | Avamar | 6.1.101-87 | All | All | All |
| Application | Emc | Avamar | 7.0 | All | All | All |
| Application | Emc | Avamar | 7.0 | sp1 | All | All |
| Application | Emc | Avamar | 6.0.1 | All | All | All |
| Application | Emc | Avamar | 6.0.2 | All | All | All |
| Application | Emc | Avamar | 6.0.3 | All | All | All |
| Application | Emc | Avamar | 6.1 | All | All | All |
| Application | Emc | Avamar | 6.1.101-87 | All | All | All |
| Application | Emc | Avamar | 7.0 | All | All | All |
| Application | Emc | Avamar | 7.0 | sp1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| EMC Avamar Weak Password Storage ≈ Packet Storm | MISC | packetstormsecurity.com | |
| 20141022 ESA-2014-094: EMC Avamar Weak Password Storage Vulnerability | BUGTRAQ | archives.neohapsis.com | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| EMC Avamar Password Hardening Package Weak Encryption Algorithm Lets Local Users Decrypt Passwords - SecurityTracker | SECTRACK | www.securitytracker.com | |
| EMC Avamar CVE-2014-4623 Password Encryption Weakness | BID | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.