CVE-2014-0646: Medium severity EMC RSA Access Manager vulnerability
The runtime WS component in the server in EMC RSA Access Manager 6.1.3 before 6.1.3.39, 6.1.4 before 6.1.4.22, 6.2.0 before 6.2.0.11, and 6.2.1 before 6.2.1.03, when INFO logging is enabled, allows local users to discover cleartext passwords by reading log files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EMC RSA Access Manager runtime WSto a version that resolves this vulnerability.Fixed in 6.1.3.39 - Upgrade
Upgrade
EMC RSA Access Manager runtime WSto a version that resolves this vulnerability.Fixed in 6.1.4.22 - Upgrade
Upgrade
EMC RSA Access Manager runtime WSto a version that resolves this vulnerability.Fixed in 6.2.0.11 - Upgrade
Upgrade
EMC RSA Access Manager runtime WSto a version that resolves this vulnerability.Fixed in 6.2.1.03 - Configuration
Disable INFO logging on the server to prevent cleartext password exposure via log files.
EMC RSA Access Manager runtime WS INFO logging = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0646?
CVE-2014-0646 is considered a moderate severity vulnerability due to the potential exposure of cleartext passwords in log files.
How do I fix CVE-2014-0646?
To fix CVE-2014-0646, update EMC RSA Access Manager to a version 6.1.3.39, 6.1.4.22, 6.2.0.11, or 6.2.1.03 or above where logging of sensitive information is managed securely.
Who is affected by CVE-2014-0646?
CVE-2014-0646 affects local users of EMC RSA Access Manager versions 6.1.3 prior to 6.1.3.39, 6.1.4 prior to 6.1.4.22, and 6.2 prior to 6.2.0.11.
What types of passwords can be exposed by CVE-2014-0646?
CVE-2014-0646 can expose cleartext passwords that are logged, potentially affecting user credentials.
Is CVE-2014-0646 applicable to all versions of EMC RSA Access Manager?
No, CVE-2014-0646 specifically affects versions 6.1 and 6.2 of EMC RSA Access Manager prior to their respective patched updates.