PT-2019-8747 · Infoblox · Infoblox Nios

Publicado 2019-06-17 · Atualizado 2019-06-20 · CVE-2018-10239

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Infoblox NIOS versions 6.8 through 8.4.1

Description A privilege escalation issue exists in the "support access" feature due to a weakness in the password generation algorithm. This could allow a locally authenticated administrator to gain additional privileges on an affected device and perform actions within the super user scope if they know the support access code for the current session and the algorithm to generate the support access password. The "support access" feature is disabled by default and automatically expires after 24 hours when enabled.

Recommendations For Infoblox NIOS versions 6.8 through 8.4.1, consider disabling the "support access" feature until a patch is available to prevent potential exploitation. As a temporary workaround, restrict the use of the "support access" feature to minimize the risk of privilege escalation. Ensure that only necessary personnel have access to the support access code and are aware of the potential vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2018-10239

Produtos afetados

Infoblox Nios

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-10239 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10239 · Aviso do Fabricante
• https://community.infoblox.com/t5/Security-Blog/10427-NIOS-Privilege-Escalation-Vulnerability/ba-p/17309 · Aviso do Fabricante
• https://t.me/cibsecurity/4944 · Publicação no Telegram