CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/93906

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.0.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.3:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.4:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.1:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.2.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.3:::::::*

cpe:2.3:h:ibm:storwize_unified_v7000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2014-09-15 14:55

Updated : 2024-02-04 18:35

NVD link : CVE-2014-3077

Mitre link : CVE-2014-3077

CVE.ORG link : CVE-2014-3077

JSON object : View

Products Affected

ibm

storwize_v7000_unified_software
storwize_unified_v7000

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-3077", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-09-15T14:55:11.260", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93906", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file."}, {"lang": "es", "value": "IBM SONAS y System Storage Storwize V7000 Unified (tambi\u00e9n conocido como V7000U) 1.3.x y 1.4.x anterior a 1.4.3.4 almacena la contrase\u00f1a chkauth en el registro de auditor\u00eda, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura del registro."}], "lastModified": "2017-08-29T01:34:38.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2890B04-AB96-4B1F-90B0-3F365FD6EF0D"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE9CC5C3-AE3E-4A24-B35B-3CD35D6D4414"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAEA5EAD-5341-429C-9DD4-DEB311485D68"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F9B4C74-9135-4775-AC09-D79BEFF2BD3E"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1420861-4678-4282-BFD7-5933C48269F6"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02299B18-7BD4-4F39-A5FA-6FFE92F9A12D"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C1FF672-811A-43AF-B7C8-61FF78952B7F"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63BD0102-EDB1-46D6-9EF1-D4002BCDBE14"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D522173E-9C93-445A-B0DA-B11614C2DDCD"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBA57121-8A60-41CB-B767-59A516772DB0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:storwize_unified_v7000:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "969B07CF-DEB1-4463-B361-D6A49642F75A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}