CVEvulnerability
CVE-2016-0917
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2016-09-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate NTLM challenge-response nonces, which makes it easier for remote attackers to execute arbitrary code, or read or write to files, via a series of authentication requests, a related issue to CVE-2010-0231.
Affected configurations
• emc vnx1 oe firmware
• emc vnx2 oe firmware
• emc vnxe oe firmware
Related
Weakness · not in database (1)
References
- http://seclists.org/bugtraq/2016/Sep/32 Third Party Advisory
- http://www.securityfocus.com/archive/1/539993/30/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/93023 www.securityfocus.com
- http://www.securitytracker.com/id/1036843 www.securitytracker.com
- http://seclists.org/bugtraq/2016/Sep/32 Third Party Advisory
- http://www.securityfocus.com/archive/1/539993/30/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/93023 www.securityfocus.com
- http://www.securitytracker.com/id/1036843 www.securitytracker.com