CVE-2016-0917
First published: Wed Sep 21 2016(Updated: )
The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate NTLM challenge-response nonces, which makes it easier for remote attackers to execute arbitrary code, or read or write to files, via a series of authentication requests, a related issue to CVE-2010-0231.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EMC VNX1 OE Firmware | ||
| Emc Vnx2 Firmware | ||
| EMC VNXe OE Firmware | ||
| EMC VNX5200 | ||
| Dell EMC VNX5400 | ||
| EMC VNX5600 | ||
| EMC VNX5800 | ||
| Dell EMC VNXe1600 | ||
| EMC VNXe3100 | ||
| EMC VNXe3150 | ||
| EMC VNXe3200 | ||
| EMC VNXe3200 | ||
| EMC VNXe3300 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-0917?
CVE-2016-0917 has a high severity rating due to its potential to allow unauthorized access through NTLM challenge-response vulnerabilities.
How do I fix CVE-2016-0917?
To fix CVE-2016-0917, upgrade the affected EMC VNXe or VNX firmware to the latest available version that addresses this vulnerability.
What systems are affected by CVE-2016-0917?
CVE-2016-0917 affects EMC VNXe3200, VNXe3100/3150/3300, VNX1 File OE, VNX2 File OE and all versions of Celerra.
What type of vulnerability is CVE-2016-0917?
CVE-2016-0917 is a security vulnerability related to improper handling of NTLM authentication in the SMB service.
Is there a workaround for CVE-2016-0917?
There is no official workaround for CVE-2016-0917; the recommended solution is to apply the firmware updates as soon as possible.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/emc
- canonical/emc vnx1 oe firmware
- canonical/emc vnx2 firmware
- canonical/emc vnxe oe firmware
- canonical/emc vnx5200
- canonical/dell emc vnx5400
- canonical/emc vnx5600
- canonical/emc vnx5800
- canonical/dell emc vnxe1600
- canonical/emc vnxe3100
- canonical/emc vnxe3150
- canonical/emc vnxe3200
- canonical/emc vnxe3300