PT-2016-7341 · Vmware · Vmware Vsphere Data Protection

Published 2016-12-29 · Updated 2017-01-03 · CVE-2016-7456

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vSphere Data Protection (VDP) versions 5.5.x through 6.1.x

Description The issue allows remote attackers to obtain login access via an SSH session, as the SSH private key has a publicly known password.

Recommendations For versions 5.5.x through 6.1.x, consider changing the SSH private key password to a strong, unique password to prevent unauthorized access. As a temporary workaround, restrict SSH access to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2016-7456

Affected Products

Vmware Vsphere Data Protection

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/vmware_vdp_known_privkey.rb · Exploit
• https://osv.dev/vulnerability/CVE-2016-7456 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7456 · Security Note
• http://vmware.com/security/advisories/VMSA-2016-0024.html · Vendor Advisory
• http://securityfocus.com/bid/94990 · Note
• http://securitytracker.com/id/1037502 · Note