PT-2017-6843 · Red Hat · Red Hat Enterprise Virtualization Manager

Kurt Seifried · Published 2017-08-24 · Updated 2017-09-07 · CVE-2015-5293

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization Manager versions 3.6 and earlier

Description The issue allows remote attackers to communicate with a system designated to be unreachable by giving valid SLAAC IPv6 addresses to interfaces when the "boot protocol" is set to None.

Recommendations For Red Hat Enterprise Virtualization Manager versions 3.6 and earlier, update the configuration to prevent assignment of valid SLAAC IPv6 addresses when the "boot protocol" is set to None.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-5293

Affected Products

Red Hat Enterprise Virtualization Manager

References · 3

• https://access.redhat.com/security/cve/CVE-2015-5293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5293 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1267714 · Vendor Advisory