-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
ESA-2014-087: EMC NetWorker Module for MEDITECH (NMMEDI) Information Disclosure Vulnerability
EMC Identifier: ESA-2014-087
CVE Identifier: CVE-2014-4620
Severity Rating: CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Affected products:
• EMC NetWorker Module for MEDITECH (NMMEDI) version 3.0 builds 87-90.
Summary:
A vulnerability exists in the EMC NetWorker Module for MEDITECH when used with EMC RecoverPoint that could potentially allow exposure of sensitive information.
Details:
As part of changes implemented in NMMEDI 3.0 build 87, Plink commands print RecoverPoint Appliance logon IDs and passwords in clear text in the NMMEDI log files.
Resolution:
The following EMC NetWorker products contain resolutions to this issue:
• EMC NetWorker Module for MEDITECH 3.0 build 92 or later
• EMC NetWorker Module for MEDITECH 8.2 Build 479 (Windows x64) or later
(Important! For NMMEDI 8.2, review the NetWorker Software Compatibility Guide for information on product compatibility).
To address this issue, customers must perform the following steps:
Link to remedies:
EMC NMMEDI Software and Information: To download software and obtain additional information for NMMEDI, refer to support.emc.com. Select “Support by Product” and type “NetWorker Module for MEDITECH”. From this page select “Downloads,” “Documentation” or “Advisories” as required.
Note: to obtain NMMEDI v3.0 build 92, DO NOT download NMMEDI v3.0 Full Release versions from download link. Expand UPDATES menu and select NetWorker Module for MEDITECH 3.0 Cumulative Hotfixes link.
EMC RecoverPoint Software and Information: To download software and obtain additional information for RecoverPoint, refer to support.emc.com. Select “Support by Product” and type “RecoverPoint”. Select your RecoverPoint product. From this page select “Downloads,” “Documentation” or “Advisories” as required.
EMC Product Security Response Center
[email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Cygwin)
iEYEARECAAYFAlRHvrcACgkQtjd2rKp+ALwfAQCfdwenOyA6/lDPgQH7cgA6J37N
3hUAoMuwPV6TgbG2MJknaJKkAvR9/MzS
=HPFH
-----END PGP SIGNATURE-----