Vulnerabilities > CVE-2016-0907 - 7PK - Security Features vulnerability in EMC Isilon Onefs and Isilonsd Edge Onefs

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

emc

CWE-254

NVD

Published: 2016-05-30

Updated: 2017-08-08

Summary

EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream, a similar issue to CVE-2016-2115.

Vulnerable Configurations

Part	Description	Count
OS	Emc EMC Isilon Onefs 7.1.0.0 EMC Isilon Onefs 7.1.0.1 EMC Isilon Onefs 7.1.0.2 EMC Isilon Onefs 7.1.0.3 EMC Isilon Onefs 7.1.0.4 EMC Isilon Onefs 7.1.0.5 EMC Isilon Onefs 7.1.0.6 EMC Isilon Onefs 7.1.1.0 EMC Isilon Onefs 7.1.1.1 EMC Isilon Onefs 7.1.1.2 EMC Isilon Onefs 7.1.1.3 EMC Isilon Onefs 7.1.1.4 EMC Isilon Onefs 7.1.1.5 EMC Isilon Onefs 7.1.1.6 EMC Isilon Onefs 7.1.1.7 EMC Isilon Onefs 7.1.1.8 EMC Isilon Onefs 7.1.1.9 EMC Isilon Onefs 7.2.0.0 EMC Isilon Onefs 7.2.1.0 EMC Isilon Onefs 7.2.1.1 EMC Isilon Onefs 7.2.1.2 EMC Isilon Onefs 8.0.0.0 EMC Isilonsd Edge Onefs 8.0.0.0	23

Common Weakness Enumeration (CWE)

CWE-254 - 7PK - Security Features

References

http://seclists.org/bugtraq/2016/May/117