CVE-2014-3077: Infoleak
Published Sep 15, 2014
·Updated
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.
Affected Software
11 affected components
IBM Storwize V7000 Unified Software=1.3.0.0
IBM Storwize V7000 Unified Software=1.3.2.0
IBM Storwize V7000 Unified Software=1.3.2.3
IBM Storwize V7000 Unified Software=1.4.0.0
IBM Storwize V7000 Unified Software=1.4.0.4
IBM Storwize V7000 Unified Software=1.4.1.0
IBM Storwize V7000 Unified Software=1.4.1.1
IBM Storwize V7000 Unified Software=1.4.2.0
IBM Storwize V7000 Unified Software=1.4.3.0
IBM Storwize V7000 Unified Software=1.4.3.3
IBM Storwize Unified V7000
Event History
Sep 15, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3077?
CVE-2014-3077 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2014-3077?
To mitigate CVE-2014-3077, update to IBM Storwize V7000 Unified version 1.4.3.4 or later.
3
What information is exposed due to CVE-2014-3077?
CVE-2014-3077 exposes the chkauth password in the audit log, allowing local users to read sensitive information.
4
Which products are affected by CVE-2014-3077?
CVE-2014-3077 affects IBM SONAS and System Storage Storwize V7000 Unified versions 1.3.x and 1.4.x before 1.4.3.4.
5
Can local users exploit CVE-2014-3077 easily?
Yes, local users can exploit CVE-2014-3077 by accessing the audit log where the password is stored.