PT-2023-10639 · Rapid7 · Nexpose+1

Ken Mizota · Publicado 2023-01-12 · Atualizado 2025-04-08 · CVE-2017-5242

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nexpose virtual appliances versions downloaded between April 5th, 2017 and May 3rd, 2017 InsightVM virtual appliances versions downloaded between April 5th, 2017 and May 3rd, 2017

Description The issue concerns Nexpose and InsightVM virtual appliances that were downloaded between April 5th, 2017 and May 3rd, 2017. These appliances contain identical SSH host keys, which is unusual because a unique SSH host key should be generated the first time a virtual appliance boots.

Recommendations For Nexpose virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017, consider regenerating the SSH host key to ensure uniqueness. For InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017, consider regenerating the SSH host key to ensure uniqueness. As a temporary workaround, restrict access to the SSH service until a unique SSH host key can be generated.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-321

CWE-330

Identificadores relacionados

CVE-2017-5242

Produtos afetados

Insightvm

Nexpose

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-5242 · Nota de Segurança
• https://rapid7.com/blog/post/2017/05/17/rapid7-nexpose-virtual-appliance-duplicate-ssh-host-key-cve-2017-5242 · Aviso do Fabricante
• https://t.me/cvenotify/118227 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-5242 · Aviso do Fabricante
• https://t.me/cibsecurity/56451 · Publicação no Telegram