Vulnerability Report

CVE-2017-14387

Title: Emc Isilon Onefs

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-14387.

CWE Category NVD-CWE-noinfo

Published Date Dec 20, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 6.5 CVSS v3.0

Exploit Probability (EPSS)

0.91%

Vulnerability Summary

CVE-2017-14387: The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the NFS export security flavor for authentication) that can be leveraged by current and future NFS exports. This NFS service contained a flaw that did not properly propagate changes made to the default security flavor to all new and existing NFS exports that are configured to use default NFS export settings and that are mounted after those changes are made. This flaw may potentially allow NFS clients to access affected NFS exports using the default and potentially weaker security flavor even if a more secure one was selected to be used by the OneFS administrator, aka an "NFS Export Security Setting Fallback Vulnerability."

Impacted Vendors

emc 1

Reference Links

http://seclists.org/fulldisclosure/2017/Dec/78 http://www.securityfocus.com/bid/102292 http://seclists.org/fulldisclosure/2017/Dec/78 http://www.securityfocus.com/bid/102292

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.4

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns