EMC AppSync Server Hardcoded Password Vulnerability

EMC AppSync Hardcoded Password Vulnerability

CVE Identifier: CVE-2017-14376
Severity Rating: CVSS v3 Base Score: 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected products:  
EMC AppSync Server versions prior to 3.5.0.1

Summary:  
EMC AppSync contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system. 
Details:  
EMC AppSync contains hardcoded passwords for database accounts with administrative privileges. Affected accounts are "apollosuperuser" and "apollouser".  An attacker with local access to the database and knowledge of the password may potentially gain unauthorized access to the database. Note: Remote access to AppSync PostgreSQL is disabled. 

Resolution:  
The following EMC AppSync release contains resolutions to this vulnerability:
*  EMC AppSync Sever version 3.5.0.1

EMC recommends all customers upgrade at the earliest opportunity. 

Link to remedies:

Customers can download software from https://download.emc.com/downloads/DL86785

#  0day.today [2018-01-09]  #