PT-2016-3727 · Hewlett Packard · Hpe Helion Eucalyptus

Publicado 2016-01-05 · Atualizado 2016-11-28 · CVE-2015-6861

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HPE Helion Eucalyptus versions 3.4.0 through 4.2.0

Description The issue allows remote authenticated users to bypass an intended permission requirement, specifically the AssumeRole permission, and assume an IAM role. This is achieved by leveraging a policy setting for a user's account.

Recommendations For versions 3.4.0 through 4.2.0, consider restricting the policy settings for user accounts to prevent unauthorized assumption of IAM roles until a patch is available. As a temporary workaround, review and limit the use of AssumeRole permissions to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-6861

Produtos afetados

Hpe Helion Eucalyptus

Referências · 3

• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926482 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6861 · Nota de Segurança
• http://securityfocus.com/bid/79650 · Nota