PT-2016-4483 · Vmware+1 · Vcloud+2

Published 2016-09-18 · Updated 2016-11-28 · CVE-2016-0930

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry (PCF) Ops Manager versions 1.6.0 through 1.6.18 Pivotal Cloud Foundry (PCF) Ops Manager versions 1.7.0 through 1.7.9

Description The issue allows remote attackers to obtain SSH access to compilation VMs by connecting within an installation-time period during which these VMs exist, due to a default password. This is possible when vCloud or vSphere is used.

Recommendations For Pivotal Cloud Foundry (PCF) Ops Manager versions 1.6.0 through 1.6.18, update to version 1.6.19 or later. For Pivotal Cloud Foundry (PCF) Ops Manager versions 1.7.0 through 1.7.9, update to version 1.7.10 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2016-0930

Affected Products

Pivotal Cloud Foundry (Pcf) Ops Manager

Vcloud

Vsphere

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-0930 · Security Note
• https://pivotal.io/security/cve-2016-0930 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-0930 · Vendor Advisory
• http://securityfocus.com/bid/93027 · Note