CVE-2014-0875

Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=ssg1S1004738	Vendor Advisory
http://www.securityfocus.com/bid/68398

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.3.0.0:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.3.1.0:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.0:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.1:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.2:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.3:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.4:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.5:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.1.0:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.1.1:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.2.0:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.2.1:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.3.0:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.3.1:::::::*
	cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.3.2:::::::*

cpe:2.3:h:ibm:storwize_unified_v7000:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2014-07-07 11:01

Updated : 2024-02-28 12:20

NVD link : CVE-2014-0875

Mitre link : CVE-2014-0875

CVE.ORG link : CVE-2014-0875

JSON object : View

Products Affected

ibm

storwize_unified_v7000_software
storwize_unified_v7000

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-0875", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-07-07T11:01:29.087", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1004738", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/68398", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Active Cloud Engine (ACE) in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions."}, {"lang": "es", "value": "Active Cloud Engine (ACE) en IBM Storwize V7000 Unified 1.3.0.0 hasta 1.4.3.x permite a atacantes remotos evadir las restricciones ACL en circunstancias oportunistas mediante el aprovechamiento de la sincronizaci\u00f3n ACL incorrecta sobre una conexi\u00f3n NFS no fiable que requiere retransmisiones."}], "lastModified": "2017-01-07T02:59:34.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4081A9F2-F548-497E-B416-A9FDD793348A"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CA982FB-D1DC-463F-8C41-351F0483ECFB"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A9E3208-9ED0-4D9F-A06A-7A568032251C"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFE8A36E-E2FD-47F7-AA04-9E6651314E9E"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BB4EEAC-1451-4819-BF01-4398B328137B"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C22A768-16FA-46B4-A1BC-79C6C0329771"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE4DF44F-794B-426A-9A2C-AA2BEFF8576C"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EB7D3C9-A45C-4437-8B47-40DA0502B771"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BAF011E-B681-4043-B90B-2703508CED2B"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A12F0D1C-0BBD-425E-8110-B93A654A7CD1"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBA9D506-2F37-403D-8112-5E1D941AB4D1"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD6D34A9-01C1-4375-99FE-F6950AA05966"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80773895-6CCF-4BF5-9811-5C493AE89BEB"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E10B3657-19BD-4972-8869-653C5078CE7B"}, {"criteria": "cpe:2.3:a:ibm:storwize_unified_v7000_software:1.4.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D89CF74-DB65-4A5C-AF00-55134B0F041E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:storwize_unified_v7000:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "969B07CF-DEB1-4463-B361-D6A49642F75A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}