PT-2018-11148 · Vmware+4 · Vcloud+4

Published 2018-04-18 · Updated 2019-10-03 · CVE-2018-1240

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC ViPR Controller versions after 3.0.0.38

Description The issue concerns an information exposure in the VRRP, where the cluster password is sent in plaintext through multicast due to an insecure default configuration in Linux's keepalived component. A malicious user with access to the vCloud subnet could potentially intercept the password and use it to take control of the cluster's virtual IP, leading to a denial of service on the affected system.

Recommendations For versions after 3.0.0.38, consider reconfiguring the VRRP to use a secure configuration, ensuring the cluster password is not sent in plaintext. As a temporary workaround, restrict access to the vCloud subnet where ViPR is deployed to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1240

Affected Products

Dell Emc Vipr Controller

Linux

Vrrp

Keepalived

Vcloud

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-1240 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1240 · Vendor Advisory
• http://seclists.org/fulldisclosure/2018/Apr/29 · Note