// For flags

CVE-2017-14385

 

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family, versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family, all versions; EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1; and EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2. EMC Data Domain DD OS contains a memory overflow vulnerability in SMBv1 which may potentially be exploited by an unauthenticated remote attacker. An attacker may completely shut down both the SMB service and active directory authentication. This may also allow remote code injection and execution.

Se ha descubierto un problema en la familia de productos EMC Data Domain DD OS 5.7, en versiones anteriores a la 5.7.5.6; la familia de productos EMC Data Domain DD OS 6.0, en versiones anteriores a la 6.0.2.9; la familia de productos EMC Data Domain DD OS 6.1, en versiones anteriores a la 6.1.0.21; la familia de productos EMC Data Domain Virtual Edition 2.0 en todas sus versiones; la familia de productos EMC Data Domain Virtual Edition 3.0, en versiones anteriores a la 3.0 SP2 Update 1 y la familia de productos EMC Data Domain Virtual Edition 3.1, en versiones anteriores a la 3.1 Update 2. EMC Data Domain DD OS contiene una vulnerabilidad de desbordamiento de memoria en SMBv1, que podría ser explotada por un atacante remoto no autenticado. Un atacante podría cerrar por completo tanto la autenticación del directorio activo como del servicio SMB. Esto también podría permitir la inyección y ejecución remotas de código.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-09-12 CVE Reserved
  • 2017-12-20 CVE Published
  • 2023-11-30 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Emc
Search vendor "Emc"
 Data Domain
Search vendor "Emc" for product "Data Domain"
 2.0
Search vendor "Emc" for product "Data Domain" and version "2.0"
virtual
Affected
Emc
Search vendor "Emc"
 Data Domain
Search vendor "Emc" for product "Data Domain"
 3.0
Search vendor "Emc" for product "Data Domain" and version "3.0"
virtual
Affected
Emc
Search vendor "Emc"
 Data Domain
Search vendor "Emc" for product "Data Domain"
 3.0
Search vendor "Emc" for product "Data Domain" and version "3.0"
sp2, virtual
Affected
Emc
Search vendor "Emc"
 Data Domain
Search vendor "Emc" for product "Data Domain"
 3.1
Search vendor "Emc" for product "Data Domain" and version "3.1"
update_2, virtual
Affected
Emc
Search vendor "Emc"
 Data Domain Os
Search vendor "Emc" for product "Data Domain Os"
 >= 5.7 < 5.7.5.6
Search vendor "Emc" for product "Data Domain Os" and version " >= 5.7 < 5.7.5.6"
-
Affected
Emc
Search vendor "Emc"
 Data Domain Os
Search vendor "Emc" for product "Data Domain Os"
 >= 6.0 < 6.0.2.9
Search vendor "Emc" for product "Data Domain Os" and version " >= 6.0 < 6.0.2.9"
-
Affected
Emc
Search vendor "Emc"
 Data Domain Os
Search vendor "Emc" for product "Data Domain Os"
 >= 6.1 < 6.1.0.21
Search vendor "Emc" for product "Data Domain Os" and version " >= 6.1 < 6.1.0.21"
-
Affected