{"status":"success","advisory":{"_id":"683547205b16347a91c39c68","kb_acknowledgements":null,"kb_affected_list":["Cluster Network Switch (NetApp CN1610)","Clustered Data ONTAP","FlashRay","NetApp VTL","OnCommand Balance","OnCommand Performance Manager (Unified Manager Performance Pkg)","OnCommand Unified Manager for Clustered Data ONTAP","Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.7 and above","StorageGRID9 (9.x and prior)","Virtual Storage Console for VMware vSphere 9.7 and above"],"kb_bad_data":false,"kb_cve":["CVE-2015-5600"],"kb_exploitation":"Public","kb_fixes":[{"product":"Clustered Data ONTAP","fixes":[{"link":"http://mysupport.netapp.com/NOW/download/software/ontap/8.3.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"NetApp VTL","fixes":[],"instructions":null,"wontfix":true,"eos_link":"mysupport.netapp.com/info/eoa/df_eoa_category_page.html?category=Platforms#ECMLP2562710"},{"product":"OnCommand Balance","fixes":[],"instructions":null,"wontfix":true,"eos_link":"https://mysupport.netapp.com/info/communications/ECMP1655122.html"},{"product":"FlashRay","fixes":[],"instructions":null,"wontfix":true,"eos_link":"n/a"},{"product":"Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.7 and above","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/sra_cmode/7.2/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Cluster Network Switch (NetApp CN1610)","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/sanswitch/fcp/NetApp/cn1610cm","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"OnCommand Performance Manager (Unified Manager Performance Pkg)","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/oncommand_pm/7.1/","cves":[]},{"link":"https://mysupport.netapp.com/NOW/download/software/oncommand_pm_linux/7.1/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"Virtual Storage Console for VMware vSphere 9.7 and above","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/vsc_win/7.2/","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"StorageGRID9 (9.x and prior)","fixes":[{"link":"https://www.suse.com/security/cve/CVE-2015-5600.html","cves":[]},{"link":"https://kb.netapp.com/support/index?page=content&id=1014874","cves":[]}],"instructions":"","wontfix":false,"eos_link":null},{"product":"OnCommand Unified Manager for Clustered Data ONTAP","fixes":[{"link":"https://mysupport.netapp.com/NOW/download/software/oncommand_cdot_lin/7.1/","cves":[]},{"link":"https://mysupport.netapp.com/NOW/download/software/oncommand_cdot_win/7.1/","cves":[]},{"link":"https://mysupport.netapp.com/NOW/download/software/oncommand_cdot/7.1","cves":[]}],"instructions":"","wontfix":false,"eos_link":null}],"kb_impact":"Exploitation of this vulnerability may lead to brute-force attacks.","kb_internal_notes":[{"burt":"1065112","jira":"","product":"Cluster Network Switch (NetApp CN1610)"},{"burt":"930621","jira":"","product":"Clustered Data ONTAP"},{"burt":"930626","jira":"","product":"Data ONTAP Edge"},{"burt":"930622","jira":"","product":"Data ONTAP operating in 7-Mode"},{"burt":"930618","jira":"","product":"FlashRay"},{"burt":"1148582","jira":"","product":"NetApp VASA Provider for Clustered Data ONTAP 9.7 and above"},{"burt":"930627","jira":"","product":"NetApp VTL"},{"burt":"930614","jira":"","product":"OnCommand Balance"},{"burt":"930620","jira":"","product":"OnCommand Performance Manager (Unified Manager Performance Pkg)"},{"burt":"930615","jira":"","product":"OnCommand Unified Manager Core Package"},{"burt":"930619","jira":"","product":"OnCommand Unified Manager for Clustered Data ONTAP"},{"burt":"930628","jira":"","product":"Perfstat"},{"burt":"930613","jira":"","product":"RapidData Migration Solution"},{"burt":"930611","jira":"","product":"Service Processor"},{"burt":"1148581","jira":"","product":"Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 9.7 and above"},{"burt":"1148584","jira":"","product":"Storage Replication Adapter for Clustered Data ONTAP for Windows 7.2 and above"},{"burt":"930624","jira":"","product":"StorageGRID (formerly StorageGRID Webscale)"},{"burt":"930623","jira":"","product":"StorageGRID9 (9.x and prior)"},{"burt":"1148585","jira":"","product":"Virtual Storage Console for VMware vSphere 9.7 and above"}],"kb_investigating_list":[],"kb_num":"9010048","kb_ref":["https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5600","https://security-tracker.debian.org/tracker/CVE-2015-5600"],"kb_rev_history":[{"comment":"Initial Public Release","date":"20151106","version":"1.0"},{"comment":"Data ONTAP Edge, StorageGRID moved to Affected Products; StorageGRID added to Software Versions and Fixes; StorageGRID Webscale, Cisco MDS, Cisco Nexus 5k/6k & Cluster Network/Management Switches (Cisco) moved to Products Not Affected","date":"20150209","version":"2.0"},{"comment":"NetApp VASA Provider for Clustered Data ONTAP added to Software Versions and Fixes","date":"20160308","version":"3.0"},{"comment":"FlashRay removed due to EOL;OnCommand Balance moved from Affected Products to Products Not Affected after investigation showed that it is not exploitable due to the default SSH settings in Debian. OnCommand Unified Manager for Clustered Data ONTAP (6.x) & OnCommand Performance Manager (Unified Manager Performance Pkg) are listed as not affected for the same reason as OnCommand Balance.","date":"20160329","version":"4.0"},{"comment":"Formatting; OnCommand Unified Manager for Clustered Data ONTAP (6.x) moved to Products With Revised Vulnerability Status after additional investigation; OnCommand Balance, Cluster Network/Management Switches (NetApp) moved to Affected Products; Data ONTAP Edge moved to Products Not Affected after additional investigation","date":"20160831","version":"5.0"},{"comment":"Perfstat moved to Products Not Affected","date":"20160906","version":"6.0"},{"comment":"Cluster Network Switch (Cisco Nexus 5596UP/5596T), Fibre Channel Switch (Cisco MDS), and Fibre Channel Switch (Cisco Nexus) moved to Products With Revised Vulnerability Status, OnCommand Unified Manager Core Package (5.x) moved to Products Not Affected","date":"20161223","version":"7.0"},{"comment":"OnCommand Performance Manager (Unified Manager Performance Pkg) moved to Products With Revised Vulnerability Status, OnCommand Performance Manager (Unified Manager Performance Pkg) and OnCommand Unified Manager for Clustered Data added to Software Versions and Fixes","date":"20170207","version":"8.0"},{"comment":"OnCommand Balance moved to Won't Fix status","date":"20180122","version":"9.0"},{"comment":"Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 4.x and above and Virtual Storage Console for VMware vSphere 7.0 and above moved to Affected Products, Storage Replication Adapter for Clustered Data ONTAP for Windows 4.x and above moved to Products Not Affected","date":"20180424","version":"10.0"},{"comment":"Virtual Storage Console for VMware vSphere 7.0 and above, Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere 4.x and above added to Software Versions and Fixes","date":"20180717","version":"11.0"},{"comment":"Cluster Network Switch (NetApp CN1610) added to Software Versions and Fixes","date":"20180823","version":"12.0"},{"comment":"On further investigation NetApp VASA Provider for Clustered Data ONTAP 7.0 moved to Products Not Affected, Final Status","date":"20181121","version":"13.0"}],"kb_revised_list":[],"kb_scoring":{"CVE-2015-5600":"CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N/E:POC/RL:U/RC:C"},"kb_scoring_calc":[{"cve_id":"CVE-2015-5600","range":"MEDIUM","score":5.8,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N/E:POC/RL:U/RC:C"}],"kb_status":"Final","kb_summary":"Multiple NetApp products incorporate the OpenSSH software libraries. OpenSSH versions below 7.0 are susceptible to a vulnerability that could be exploited to bypass the maximum number of authentication attempts and launch brute force attacks. NetApp is investigating which products use affected versions of OpenSSH. This advisory will be updated as additional information becomes available.","kb_title":"CVE-2015-5600 OpenSSH MaxAuthTries Bypass Vulnerability in NetApp Products","kb_unaffected_list":["7-Mode Transition Tool","ATTO FibreBridge - 6500N","Brocade Fabric Operating System Firmware","Cloud Manager","Clustered Data ONTAP Antivirus Connector","Data ONTAP Edge","Data ONTAP operating in 7-Mode","E-Series SANtricity Storage Manager","E-Series SANtricity Web Services (REST API) for Web Services Proxy","FAS/AFF BIOS","Host Utilities - SAN for Linux","Host Utilities - SAN for Windows","NetApp Cloud Backup (formerly AltaVault)","NetApp Manageability SDK","NetApp NFS Plug-in for VMware VAAI","NetApp SANtricity SMI-S Provider","NetApp SMI-S Provider","NetApp Storage Encryption","NetApp VASA Provider for Clustered Data ONTAP 9.7 and above","OnCommand Insight","OnCommand Unified Manager Core Package","OnCommand Workflow Automation","Open Systems SnapVault Agent","Perfstat","RapidData Migration Solution","Service Processor","Single Mailbox Recovery","Snap Creator Framework","SnapDrive for Unix","SnapManager for Exchange","SnapManager for Hyper-V","SnapManager for Oracle","SnapManager for SAP","SnapManager for Sharepoint","Storage Replication Adapter for Clustered Data ONTAP for Windows 7.2 and above","Storage Services Connector","StorageGRID (formerly StorageGRID Webscale)","System Manager 9.x"],"kb_workarounds":"None.","ntap_advisory_id":"NTAP-20151106-0001","adv_id":"ntap-20151106-0001","published_date":"2015-11-06T00:00:00","updated_date":"2018-11-21T00:00:00","inserted_date":"2025-05-27T05:01:20.273000","modified_date":null}}