PT-2016-2287 · Solarwinds · Solarwinds Virtualization Manager

Nate Kettlewell · Publicado 2016-06-17 · Atualizado 2025-03-07 · CVE-2016-3643

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SolarWinds Virtualization Manager versions 6.3.1 and earlier

Description The issue is related to a misconfiguration of sudo in SolarWinds Virtualization Manager, which can be exploited by a local attacker to gain elevated privileges. This can be demonstrated by executing commands such as sudo cat /etc/passwd.

Recommendations For SolarWinds Virtualization Manager versions 6.3.1 and earlier, correct the sudo misconfiguration to prevent privilege escalation. Ensure that sudo is properly configured to restrict unauthorized access to sensitive files and commands.

Exploit

Correção

Enumeração de Fraquezas

CWE-16

CWE-264

Identificadores relacionados

BDU:2016-01676

CVE-2016-3643

Produtos afetados

Solarwinds Virtualization Manager

Referências · 11

• 🔥 http://packetstormsecurity.com/files/137487/Solarwinds-Virtualization-Manager-6.3.1-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/39967 · Exploit
• http://seclists.org/fulldisclosure/2016/Jun/26 · Nota
• https://bdu.fstec.ru/vul/2016-01676 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-3643 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-3643 · Aviso do Fabricante
• https://t.me/cvenotify/110006 · Publicação no Telegram
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3643 · Nota
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://t.me/cvenotify/108271 · Publicação no Telegram
• https://t.me/cvenotify/113823 · Publicação no Telegram