CVE-2014-0643

2014-05-1611:11:59

CWE-287

[email protected]

web.nvd.nist.gov

emc

rsa

netwitness

security analytics

bypass

kerberos

pam

authentication

cve-2014-0643

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.3%

JSON

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.

Affected configurations

NVD

Node

emcrsa_netwitnessRange<9.8.5.19

emcrsa_security_analyticsRange10.2–10.2.4

emcrsa_security_analyticsRange10.3–10.3.2

CPENameOperatorVersion
emc:rsa_netwitnessemc rsa netwitnesslt9.8.5.19
emc:rsa_security_analyticsemc rsa security analyticslt10.2.4
emc:rsa_security_analyticsemc rsa security analyticslt10.3.2

CPE	Name	Operator	Version
emc:rsa_netwitness	emc rsa netwitness	lt	9.8.5.19
emc:rsa_security_analytics	emc rsa security analytics	lt	10.2.4
emc:rsa_security_analytics	emc rsa security analytics	lt	10.3.2