PT-2016-7341 · Vmware · Vmware Vsphere Data Protection

Publicado 2016-12-29 · Atualizado 2017-01-03 · CVE-2016-7456

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vSphere Data Protection (VDP) versions 5.5.x through 6.1.x

Description The issue allows remote attackers to obtain login access via an SSH session, as the SSH private key has a publicly known password.

Recommendations For versions 5.5.x through 6.1.x, consider changing the SSH private key password to a strong, unique password to prevent unauthorized access. As a temporary workaround, restrict SSH access to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2016-7456

Produtos afetados

Vmware Vsphere Data Protection

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/vmware_vdp_known_privkey.rb · Exploit
• https://osv.dev/vulnerability/CVE-2016-7456 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7456 · Nota de Segurança
• http://securityfocus.com/bid/94990 · Nota
• http://securitytracker.com/id/1037502 · Nota
• http://vmware.com/security/advisories/VMSA-2016-0024.html · Aviso do Fabricante