PT-2018-1080 · Vmware · Vmware Vrealize Automation+2

CVE-2017-4947 · Publicado 2018-01-26 · Atualizado 2024-09-17

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vRealize Automation versions 7.2 through 7.3 vSphere Integrated Containers versions 1.x before 1.3

Description The issue is caused by a deserialization vulnerability via Xenon, which may allow remote attackers to execute arbitrary code on the appliance by sending specially crafted data to the Xenon service. This vulnerability exists due to the restoration in memory of an untrusted data structure.

Recommendations For VMware vRealize Automation versions 7.2 and 7.3, update to a version that contains a fix for this issue. For vSphere Integrated Containers versions 1.x before 1.3, update to version 1.3 or later. As a temporary workaround, consider restricting access to the Xenon service to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2018-00442

CVE-2017-4947

Produtos afetados

Vmware Vrealize Automation

Xenon

Vsphere Integrated Containers

Referências · 8

• https://vmware.com/security/advisories/VMSA-2018-0006.html · Aviso do Fabricante
• http://securitytracker.com/id/1040289 · Nota
• https://osv.dev/vulnerability/CVE-2017-4947 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00442 · Nota de Segurança
• http://securitytracker.com/id/1040290 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-4947 · Nota de Segurança
• https://t.me/cvenotify/94856 · Publicação no Telegram
• http://securityfocus.com/bid/102852 · Nota