PT-2016-3727 · Hewlett Packard · Hpe Helion Eucalyptus

Published 2016-01-05 · Updated 2016-11-28 · CVE-2015-6861

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HPE Helion Eucalyptus versions 3.4.0 through 4.2.0

Description The issue allows remote authenticated users to bypass an intended permission requirement, specifically the AssumeRole permission, and assume an IAM role. This is achieved by leveraging a policy setting for a user's account.

Recommendations For versions 3.4.0 through 4.2.0, consider restricting the policy settings for user accounts to prevent unauthorized assumption of IAM roles until a patch is available. As a temporary workaround, review and limit the use of AssumeRole permissions to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-6861

Affected Products

Hpe Helion Eucalyptus

References · 3

• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6861 · Security Note
• http://securityfocus.com/bid/79650 · Note