PT-2017-8327 · Cloud Foundry+1 · Login-Server+3

Publicado 2017-05-25 · Atualizado 2022-05-13 · CVE-2016-3084

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry versions prior to v236 UAA versions prior to v3.3.0 UAA versions prior to v10 Login-server all versions Pivotal Elastic Runtime versions prior to 1.7.2

Description The UAA reset password flow is vulnerable to a brute force attack due to multiple active codes at a given time. This issue is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Recommendations For Cloud Foundry versions prior to v236, update to a version later than v236. For UAA versions prior to v3.3.0, update to a version later than v3.3.0. For UAA versions prior to v10, update to a version later than v10. For Login-server all versions, consider disabling the UAA internal user store for authentication until a patch is available. For Pivotal Elastic Runtime versions prior to 1.7.2, update to a version later than 1.7.2.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-3084

GHSA-FM5C-2RWC-887W

Produtos afetados

Cloud Foundry

Login-Server

Pivotal Elastic Runtime

Uaa

Referências · 13

• https://github.com/cloudfoundry/uaa · Nota
• https://github.com/cloudfoundry/uaa/commit/b3834364ab573e9655348193780a56a602fe87b7 · Nota
• https://github.com/cloudfoundry/uaa/commit/14350228989e2aee900b8d48a848293bb5152b6f · Nota
• https://github.com/cloudfoundry/uaa/commit/66132926f1bac0b878da5841be2f93fa5075d88f · Nota
• https://github.com/cloudfoundry/uaa/commit/460627ed419e4227b10ff121248b3ffc009011a9 · Nota
• https://github.com/cloudfoundry/uaa/commit/1d3ad7399d010f6a29dc3bf8139d792121301ab8 · Nota
• https://github.com/cloudfoundry/uaa/commit/5c2377487bef9d716d5c8e5717df1fc00bc7b000 · Nota
• https://github.com/cloudfoundry/uaa/commit/4a119d314744460ed56bcd740b2e913bf3f560c1 · Nota
• https://pivotal.io/security/cve-2016-3084 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3084 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fm5c-2rwc-887w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-3084 · Aviso do Fabricante
• https://t.me/cvenotify/18787 · Publicação no Telegram