ID CVE-2013-3287
Summary EMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP configurations, allows local users to discover the cleartext LDAP bind password by reading the console.
References
Vulnerable Configurations
  • EMC Unisphere 1.6 for VMAX
    cpe:2.3:a:emc:unisphere:1.6:-:-:-:-:vmax
  • EMC Unisphere 1.5 for VMAX
    cpe:2.3:a:emc:unisphere:1.5:-:-:-:-:vmax
  • EMC Unisphere 1.1 for VMAX
    cpe:2.3:a:emc:unisphere:1.1:-:-:-:-:vmax
  • EMC Unisphere 1.0 for VMAX
    cpe:2.3:a:emc:unisphere:1.0:-:-:-:-:vmax
CVSS
Base: 1.9 (as of 04-11-2013 - 08:20)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
refmap via4
bid 63425
bugtraq 20131029 ESA-2013-074: EMC Unisphere for VMAX Information Disclosure Vulnerability
Last major update 05-11-2013 - 10:55
Published 02-11-2013 - 15:55
Back to Top