CVE-2017-8001
HighSummary
An issue was discovered in EMC ScaleIO 2.0.1.x where one of the support scripts saves the credentials of the MDM user in clear text in temporary log files. These files may be read by an unprivileged user with access to the server where the script was executed.
Risk Assessment
The risk is that unauthorized users may gain access to sensitive credential data, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to secure support scripts to avoid saving credentials in clear text and to restrict access to temporary log files.
Other vulnerabilities in EMC ScaleIO 2.0.1.x
See all- CVE-2017-8019High
An issue was discovered in EMC ScaleIO 2.0.1.x related to message parsers (MDM, SDS, and LIA) that could allow an unauthenticated remote attacker to send specially crafted packets. This could lead to stopping ScaleIO services and causing a denial of service situation.
- CVE-2016-9867High
An issue was discovered in EMC ScaleIO versions before 2.0.1.1, allowing a low-privileged local attacker to modify kernel memory in the SCINI driver. This may lead to code execution and privilege escalation to root on ScaleIO Data Client (SDC) servers.
- CVE-2017-8020Critical
A buffer overflow vulnerability was discovered in EMC ScaleIO 2.0.1.x in the SDBG service, which may allow a remote unauthenticated attacker to execute arbitrary commands with root privileges on an affected server.
Original NVD description (English source)
An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the server where the script was executed to recover exposed credentials.