CVE-2016-0912
CriticalSummary
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions. This can be achieved by leveraging access to a different account with the same role as a target account or an account's session at an unattended workstation.
Risk Assessment
The organization may be exposed to unauthorized password changes, potentially leading to account takeover and access to sensitive data.
Recommendation
It is recommended to upgrade the system to version 5.7.2.0 or later and implement additional security measures to restrict access to user sessions.
Other vulnerabilities in EMC Data Domain OS
See all- CVE-2016-0911High
EMC Data Domain OS versions 5.4 through 5.7 before 5.7.2.0 have a default no_root_squash option for NFS exports, making it easier for remote attackers to obtain filesystem access by leveraging client root privileges.
- CVE-2016-0910High
EMC Data Domain OS versions 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 store session identifiers of GUI users in a world-readable file, allowing local users to hijack arbitrary accounts via unspecified vectors.
Original NVD description (English source)
EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions by leveraging access to (1) a different account with the same role as a target account or (2) an account's session at an unattended workstation.