CVE-2017-14385: Buffer Overflow
First published: Wed Dec 20 2017(Updated: )
An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family, versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family, all versions; EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1; and EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2. EMC Data Domain DD OS contains a memory overflow vulnerability in SMBv1 which may potentially be exploited by an unauthenticated remote attacker. An attacker may completely shut down both the SMB service and active directory authentication. This may also allow remote code injection and execution.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| EMC Data Domain | =2.0 | |
| EMC Data Domain | =3.0 | |
| EMC Data Domain | =3.0-sp2 | |
| EMC Data Domain | =3.1-update_2 | |
| EMC Data Domain OS | >=5.7<5.7.5.6 | |
| EMC Data Domain OS | >=6.0<6.0.2.9 | |
| EMC Data Domain OS | >=6.1<6.1.0.21 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-14385?
The severity of CVE-2017-14385 is high.
Which versions of EMC Data Domain are affected by CVE-2017-14385?
EMC Data Domain DD OS 5.7 family versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family, all versions; EMC Data Domain Virtual Edition.
How can I fix CVE-2017-14385?
Upgrade to EMC Data Domain DD OS 5.7.5.6 or later; EMC Data Domain DD OS 6.0.2.9 or later; EMC Data Domain DD OS 6.1.0.21 or later; EMC Data Domain Virtual Edition 2.0 family, the latest version available.
What is the Common Weakness Enumeration (CWE) ID for CVE-2017-14385?
The CWE ID for CVE-2017-14385 is 94 and 119.
Where can I find more information about CVE-2017-14385?
You can find more information about CVE-2017-14385 at the following references: http://seclists.org/fulldisclosure/2017/Dec/79, http://www.securityfocus.com/bid/102289, http://www.securitytracker.com/id/1040027
- collector/nvd-index
- agent/weakness
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/emc
- canonical/emc data domain
- version/emc data domain/2.0
- version/emc data domain/3.0
- version/emc data domain/3.0-sp2
- version/emc data domain/3.1-update_2
- canonical/emc data domain os
- version/emc data domain os/5.7
- version/emc data domain os/6.0
- version/emc data domain os/6.1