Vulnerability Note VU#329772

NetApp Data ONTAP contains multiple vulnerabilities

Original Release date: 25 Jul 2008 | Last revised: 28 Jul 2008


NetApp Data ONTAP contains multiple vulnerabilities. The most severe of these vulnerabilities may allow an attacker to execute commands, view sensitive data, or cause a system to crash.


NetApp Data ONTAP contains multiple undisclosed vulnerabilities.


A remote, unauthenticated attacker may be able to execute arbitrary commands, view log files or other sensitive data, or cause a vulnerable system to crash.



These issues are fixed in new maintenance releases designated Data ONTAP 7.0.7, 7.1.3, and Administrators with active support agreements are encouraged to log in to the NetApp portal to access more information about these issues:

Operators are advised to upgrade to one of these releases as soon as possible. Administrators running systems with Data ONTAP that were purchased from an OEM other than NetApp should see their OEM for updates.

Restrict access

Some of these vulnerabilities can be mitigated by restricting access to a vulnerable system. Administrators should consider using httpd.admin.access or other access controls.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
NetAppAffected30 Jun 200828 Jul 2008
IBM eServerUnknown07 Jul 200807 Jul 2008
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



Thanks to NetApp for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: Unknown
  • Date Public: 25 Jun 2008
  • Date First Published: 25 Jul 2008
  • Date Last Updated: 28 Jul 2008
  • Severity Metric: 18.04
  • Document Revision: 15


If you have feedback, comments, or additional information about this vulnerability, please send us email.