CVE-2014-0643
High
Description
EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name.
SeverityHigh
CVSS7.6
Exploit probability—
ProductEmc Rsa Netwitness
PublishedMay 16, 2014
First seenMay 16, 2014
How to fix
Update
- emc rsa_netwitness9.8.5.19 or later
- emc rsa_security_analytics10.2.4, 10.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emc rsa_netwitness | v < 9.8.5.19 | 9.8.5.19 |
| emc rsa_security_analytics | 10.2 ≤ v < 10.2.4, 10.3 ≤ v < 10.3.2 | 10.2.4, 10.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.