Unscored severity · published Oct 25, 2014
CVE-2014-4623
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for…
–
CVSS
1.6%
EPSS
No
On KEV
Description
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
Avamar · Emc
6.0.1; 6.0.2; 6.0.3; 6.1; 6.1.101-87; 7.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4623
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2014-10/0146.html
packetstormsecurity.com
http://packetstormsecurity.com/files/128842/EMC-Avamar-Weak-Password-Storage.html
www.securityfocus.com
http://www.securityfocus.com/bid/70732
www.securitytracker.com
http://www.securitytracker.com/id/1031117
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/97757
More from Avamar
8.8
CVE-2016-0906
The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authenticated users to read…
–
CVE-2013-0945
EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
–
CVE-2013-0944
The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL
–
CVE-2012-2291
EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which…
–
CVE-2012-4610
EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote attackers to obtain sensitive information by leveraging…