PT-2016-2287 · Solarwinds · Solarwinds Virtualization Manager

Nate Kettlewell · Published 2016-06-17 · Updated 2025-03-07 · CVE-2016-3643

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SolarWinds Virtualization Manager versions 6.3.1 and earlier

Description The issue is related to a misconfiguration of sudo in SolarWinds Virtualization Manager, which can be exploited by a local attacker to gain elevated privileges. This can be demonstrated by executing commands such as sudo cat /etc/passwd.

Recommendations For SolarWinds Virtualization Manager versions 6.3.1 and earlier, correct the sudo misconfiguration to prevent privilege escalation. Ensure that sudo is properly configured to restrict unauthorized access to sensitive files and commands.

Exploit

Fix

Weakness Enumeration

CWE-16

CWE-264

Related Identifiers

BDU:2016-01676

CVE-2016-3643

Affected Products

Solarwinds Virtualization Manager

References · 11

• 🔥 http://packetstormsecurity.com/files/137487/Solarwinds-Virtualization-Manager-6.3.1-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/39967 · Exploit
• https://bdu.fstec.ru/vul/2016-01676 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3643 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3643 · Vendor Advisory
• http://seclists.org/fulldisclosure/2016/Jun/26 · Note
• https://t.me/cvenotify/110006 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3643 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/108271 · Telegram Post
• https://t.me/cvenotify/113823 · Telegram Post