CVE-2016-0911
HighSummary
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 have a default no_root_squash option for NFS exports, making it easier for remote attackers to obtain filesystem access by leveraging client root privileges.
Risk Assessment
This vulnerability may lead to unauthorized access to data on the server, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade the system to version 5.7.2.0 or later and configure the no_root_squash option to restrict filesystem access.
Other vulnerabilities in EMC Data Domain OS
See all- CVE-2016-0910High
EMC Data Domain OS versions 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 store session identifiers of GUI users in a world-readable file, allowing local users to hijack arbitrary accounts via unspecified vectors.
- CVE-2016-0912Critical
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions. This can be achieved by leveraging access to a different account with the same role as a target account or an account's session at an unattended workstation.
Original NVD description (English source)
EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 has a default no_root_squash option for NFS exports, which makes it easier for remote attackers to obtain filesystem access by leveraging client root privileges.