Brocade SANnav Password-Based Encryption Key Exposure Vulnerability

A vulnerability exists in Brocade SANnav versions prior to 2.4.0b, where the Password-Based Encryption (PBE) key is logged in plaintext in the system audit log. This issue arises only during migration processes, not in new installations. The audit logs, which are accessible solely to privileged users on the server, can be exploited by remote authenticated attackers who have access to these logs.

Impact

Exposing the PBE key in plaintext could allow unauthorized decryption of sensitive data, potentially leading to further exploitation.

Remediation

Users can upgrade to Brocade SANnav versions 3.0 or 2.4.0b to address this vulnerability.