-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ESA-2014-087: EMC NetWorker Module for MEDITECH (NMMEDI) Information Disclosure Vulnerability

EMC Identifier: ESA-2014-087

CVE Identifier: CVE-2014-4620

Severity Rating: CVSS v2 Base Score:  7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Affected products:  
•  EMC NetWorker Module for MEDITECH (NMMEDI) version 3.0 builds 87-90.

Summary:  

A vulnerability exists in the EMC NetWorker Module for MEDITECH when used with EMC RecoverPoint that could potentially allow exposure of sensitive information.

Details: 
As part of changes implemented in NMMEDI 3.0 build 87, Plink commands print RecoverPoint Appliance logon IDs and passwords in clear text in the NMMEDI log files.

Resolution:  
The following EMC NetWorker products contain resolutions to this issue:
•  EMC NetWorker Module for MEDITECH 3.0 build 92 or later
•  EMC NetWorker Module for MEDITECH 8.2 Build 479 (Windows x64) or later
(Important! For NMMEDI 8.2, review the NetWorker Software Compatibility Guide for information on product compatibility).

To address this issue, customers must perform the following steps:
1.  Change the RecoverPoint password (Refer to RecoverPoint documentation for steps)
2.  Delete all occurrences of disclosed logged password: 
a.  From the nsr/applogs folder on the NMMEDI machine delete the existing nsrmedisv.raw logs. 
b.  Delete any existing rendered log files.
c.  Ensure that above logs copied or uploaded to any additional location are also deleted. 
Note: The nsrmedisv.raw file can be found in the“C:\Program Files\Legato\nsr\applogs” or “C:\Program Files\EMC NetWorker\nsr\applogs” directory of the server where NMMEDI has been installed.
3.  Install NMMEDI 3.0 build 92 or NMMEDI 8.2
4.  Reconfigure new RecoverPoint password in NMMEDI User Interface
5.  Run the backups.
EMC strongly recommends all customers apply above mitigation steps at the earliest opportunity.

Link to remedies:

EMC NMMEDI Software and Information: To download software and obtain additional information for NMMEDI, refer to support.emc.com. Select “Support by Product” and type “NetWorker Module for MEDITECH”. From this page select “Downloads,” “Documentation” or “Advisories” as required.
Note: to obtain NMMEDI v3.0 build 92, DO NOT download NMMEDI v3.0 Full Release versions from download link. Expand UPDATES menu and select NetWorker Module for MEDITECH 3.0 Cumulative Hotfixes link.


EMC RecoverPoint Software and Information: To download software and obtain additional information for RecoverPoint, refer to support.emc.com. Select “Support by Product” and type “RecoverPoint”. Select your RecoverPoint product. From this page select “Downloads,” “Documentation” or “Advisories” as required.

EMC Product Security Response Center
security_alert@emc.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Cygwin)

iEYEARECAAYFAlRHvrcACgkQtjd2rKp+ALwfAQCfdwenOyA6/lDPgQH7cgA6J37N
3hUAoMuwPV6TgbG2MJknaJKkAvR9/MzS
=HPFH
-----END PGP SIGNATURE-----