Data Insight Cleartext Password Vulnerability

Revision History

• 1.0: April 15, 2025: Initial version

Description

A vulnerability was discovered in Arctera/Veritas Data Insight version 7.1.1 and prior due to account credentials potentially being sent in cleartext over the network.  This vulnerability only impacts Data Insight implementations which connect to a Dell Isilon OneFS server that is configured to support unencrypted HTTP requests.

Issue

CVE ID: To be announced

Severity: MEDIUM

CVSS v3.1 Base Score 4.7 (AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

CWE-319: Cleartext Transmission of Sensitive Information

Prerequisites

The Data Insight application connects using Basic Authentication to a Dell Isilon OneFS server which is configured to support unencrypted HTTP requests.   In this situation, a hacker on the adjacent network could potentially capture the OneFS server credentials with the use of a packet sniffer network protocol tool.

Affected Versions

Arctera/Veritas Data Insight versions: 7.1.1, 7.1, 7.0.2, 7.0.1, 7.0, 6.6.2, 6.6.1, 6.6, 6.5.2, 6.5.1, 6.5, 6.4.1, 6.4, 6.3.1, 6.3. Earlier unsupported versions may be affected as well.

Remediation

Customers under a current maintenance contract should upgrade to Arctera/Veritas Data Insight version 7.1.2 available here:

• https://www.veritas.com/support/en_US/downloads/update.UPD222037

See the Download Center for all available updates: https://www.veritas.com/support/en_US/downloads

Questions

For questions or problems regarding these vulnerabilities please contact Arctera Technical Support (https://www.arctera.io/support)

Disclaimer

THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID.  Arctera US LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION.  THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

Arctera US LLC
6200 Stoneridge Mall Road, Suite 150
Pleasanton, CA 94588