{"vuid":"VU#329772","idnumber":"329772","name":"NetApp Data ONTAP contains multiple vulnerabilities","keywords":["NetApp","DATA ONTAP"],"overview":"NetApp Data ONTAP contains multiple vulnerabilities. The most severe of these vulnerabilities may allow an attacker to execute commands, view sensitive data, or cause a system to crash.","clean_desc":"NetApp Data ONTAP contains multiple undisclosed vulnerabilities.","impact":"A remote, unauthenticated attacker may be able to execute arbitrary commands, view log files or other sensitive data, or cause a vulnerable system to crash.","resolution":"Upgrade\nThese issues are fixed in new maintenance releases designated Data ONTAP 7.0.7, 7.1.3, and 7.2.5.1. Administrators with active support agreements are encouraged to log in to the NetApp portal to access more information about these issues: http://now.netapp.com/NOW/products/cpc/cpc0807-01.shtml \nhttp://now.netapp.com/NOW/products/cpc/cpc0807-02.shtml\nhttp://now.netapp.com/NOW/products/cpc/cpc0807-03.shtml Operators are advised to upgrade to one of these releases as soon as possible. Administrators running systems with Data ONTAP that were purchased from an OEM other than NetApp should see their OEM for updates.","workarounds":"Restrict access Some of these vulnerabilities can be mitigated by restricting access to a vulnerable system. Administrators should consider using httpd.admin.access or other access controls.","sysaffected":"","thanks":"Thanks to NetApp for information that was used in this report.","author":"This document was written by Ryan Giobbi.","public":["http://www.netapp.com/us/products/platform-os/data-ontap/","http://now.netapp.com/NOW/products/cpc/cpc0807-01.shtml","http://now.netapp.com/NOW/products/cpc/cpc0807-02.shtml","http://now.netapp.com/NOW/products/cpc/cpc0807-03.shtml"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2008-06-27T17:01:13Z","publicdate":"2008-06-25T00:00:00Z","datefirstpublished":"2008-07-25T15:02:25Z","dateupdated":"2008-07-28T17:33:20Z","revision":16,"vrda_d1_directreport":"1","vrda_d1_population":"2","vrda_d1_impact":"3","cam_widelyknown":"4","cam_exploitation":"0","cam_internetinfrastructure":"15","cam_population":"15","cam_impact":"15","cam_easeofexploitation":"15","cam_attackeraccessrequired":"15","cam_scorecurrent":"18.03515625","cam_scorecurrentwidelyknown":"33.22265625","cam_scorecurrentwidelyknownexploited":"52.20703125","ipprotocol":"","cvss_accessvector":"--","cvss_accesscomplexity":"--","cvss_authentication":null,"cvss_confidentialityimpact":"--","cvss_integrityimpact":"--","cvss_availabilityimpact":"--","cvss_exploitablity":null,"cvss_remediationlevel":"ND","cvss_reportconfidence":"ND","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"ND","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"0","cvss_basevector":"AV:--/AC:--/Au:--/C:--/I:--/A:--","cvss_temporalscore":"0","cvss_environmentalscore":"0","cvss_environmentalvector":"CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND","metric":18.03515625,"vulnote":null}