PT-2018-11148 · Vmware+4 · Vcloud+4

Publicado 2018-04-18 · Atualizado 2019-10-03 · CVE-2018-1240

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC ViPR Controller versions after 3.0.0.38

Description The issue concerns an information exposure in the VRRP, where the cluster password is sent in plaintext through multicast due to an insecure default configuration in Linux's keepalived component. A malicious user with access to the vCloud subnet could potentially intercept the password and use it to take control of the cluster's virtual IP, leading to a denial of service on the affected system.

Recommendations For versions after 3.0.0.38, consider reconfiguring the VRRP to use a secure configuration, ensuring the cluster password is not sent in plaintext. As a temporary workaround, restrict access to the vCloud subnet where ViPR is deployed to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1240

Produtos afetados

Dell Emc Vipr Controller

Linux

Vrrp

Keepalived

Vcloud

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-1240 · Nota de Segurança
• http://seclists.org/fulldisclosure/2018/Apr/29 · Nota
• https://osv.dev/vulnerability/CVE-2018-1240 · Aviso do Fabricante