CVE-2002-0114 in NetWorker
Summary
by MITRE
EMC NetWorker (formerly Legato NetWorker) before 7.0 stores passwords in plaintext in the daemon.log file, which allows local users to gain privileges by reading the password from the file. NOTE: this was originally reported for Legato NetWorker 6.1 on the Solaris 7 platform.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2025
The vulnerability identified as CVE-2002-0114 affects EMC NetWorker software formerly known as Legato NetWorker version 6.1 and earlier releases on Solaris 7 platform. This represents a critical security flaw that demonstrates poor cryptographic practices and inadequate privilege management within the software's logging mechanisms. The issue stems from the application's failure to implement proper password protection measures during log file generation, creating a significant attack vector for local adversaries.
The technical flaw manifests in the daemon.log file where passwords are stored in plaintext format rather than being properly encrypted or hashed. This design decision violates fundamental security principles and creates an inherent risk when system administrators or authorized users need to authenticate with the system. The logging mechanism does not differentiate between sensitive authentication data and regular operational information, resulting in passwords being written to disk in an easily readable format that can be accessed by any user with read permissions on the file system. This represents a direct violation of security best practices and creates an immediate privilege escalation opportunity for local attackers.
The operational impact of this vulnerability is severe as it provides local users with direct access to authentication credentials that could be used to escalate privileges or gain unauthorized access to additional system resources. Attackers who can read the daemon.log file gain access to administrative passwords, potentially allowing them to impersonate legitimate users or administrators within the system. This creates a significant risk for organizations relying on the software for backup and recovery operations, as the compromise of authentication credentials could lead to unauthorized access to critical data and system resources. The vulnerability is particularly dangerous in multi-user environments where local access might not be properly restricted.
The security implications of this vulnerability align with CWE-312 (Sensitive Data Exposure) and CWE-522 (Insufficiently Protected Credentials) classifications, demonstrating how inadequate data protection mechanisms can create exploitable conditions. From an attacker perspective, this vulnerability maps to ATT&CK technique T1003.001 (OS Credential Dumping: LSASS Memory) and T1078 (Valid Accounts) as it provides a direct path to obtain valid credentials without complex exploitation techniques. Organizations should immediately implement mitigation strategies including restricting file system access to daemon.log files, implementing proper log rotation with encrypted storage, and upgrading to EMC NetWorker version 7.0 or later where this vulnerability has been addressed. System administrators should also conduct thorough audits of log file permissions and implement monitoring for unauthorized access attempts to sensitive log files. The vulnerability underscores the importance of proper input validation and secure coding practices in preventing information disclosure issues that can compromise entire systems.