CVE-2014-4623
First published: Sat Oct 25 2014(Updated: )
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EMC Avamar Virtual Edition | =6.0.1 | |
| EMC Avamar Virtual Edition | =6.0.2 | |
| EMC Avamar Virtual Edition | =6.0.3 | |
| EMC Avamar Virtual Edition | =6.1 | |
| EMC Avamar Virtual Edition | =6.1.101-87 | |
| EMC Avamar Virtual Edition | =7.0 | |
| EMC Avamar Virtual Edition | =7.0-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-4623?
CVE-2014-4623 has a medium severity due to its potential to allow brute-force password cracking.
How do I fix CVE-2014-4623?
To fix CVE-2014-4623, upgrade to an Avamar version where Password Hardening is implemented using stronger hashing algorithms.
Which versions are affected by CVE-2014-4623?
CVE-2014-4623 affects EMC Avamar versions 6.0.x, 6.1.x, and 7.0.x prior to the patch that includes enhanced password hashing.
What type of attacks does CVE-2014-4623 make easier?
CVE-2014-4623 makes it easier for attackers to execute brute-force attacks to obtain cleartext passwords.
Is CVE-2014-4623 specific to a particular environment?
CVE-2014-4623 specifically affects EMC Avamar Data Store deployments with Password Hardening enabled before version 2.0.0.4.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/event
- agent/author
- agent/first-publish-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/emc
- canonical/emc avamar virtual edition
- version/emc avamar virtual edition/6.0.1
- version/emc avamar virtual edition/6.0.2
- version/emc avamar virtual edition/6.0.3
- version/emc avamar virtual edition/6.1
- version/emc avamar virtual edition/6.1.101-87
- version/emc avamar virtual edition/7.0
- version/emc avamar virtual edition/7.0-sp1