EMC Avamar information leakage (CVE-2014-4624)

EMC Avamar information leakage (CVE-2014-4624)

Release date:
Updated on:

Affected Systems:
EMC Avamar 6.x
Description:
Bugtraq id: 70709
CVE (CAN) ID: CVE-2014-4624

EMC Avamar is a remote backup and recovery solution.

EMC Avamar Data Store (ADS), Avamar Virtual Edition (AVE) 6. versions x and 7.0.x-7.0.2-43 do not authenticate Java API calls. Remote attackers can exploit this vulnerability to obtain the grid MCUser and GSAN passwords through constructed calls.

<* Source: Jakub Mleczko
*>

Suggestion:
Vendor patch:

EMC
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.emc.com/products-solutions/index.htm
Http://archives.neohapsis.com/archives/bugtraq/2014-10/0147.html

This article permanently updates the link address: