Dell EMC ViPR Controller における情報漏えいに関する脆弱性
| Title |
Dell EMC ViPR Controller における情報漏えいに関する脆弱性
|
| Summary |
Dell EMC ViPR Controller には、情報漏えいに関する脆弱性、および証明書・パスワードの管理に関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution |
ベンダ情報および参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
April 11, 2018, midnight |
| Registration Date |
June 20, 2018, 5:10 p.m. |
| Last Update |
June 20, 2018, 5:10 p.m. |
|
CVSS3.0 : 重要
|
| Score |
8
|
| Vector |
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
CVSS2.0 : 注意
|
| Score |
2.7
|
| Vector |
AV:A/AC:L/Au:S/C:P/I:N/A:N |
Affected System
| DELL EMC (旧 EMC Corporation) |
|
ViPR Controller
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
その他
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2018年06月20日]
掲載 |
June 20, 2018, 5:10 p.m. |
NVD Vulnerability Information
CVE-2018-1240
| Summary |
Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.
|
| Publication Date |
April 19, 2018, 1:29 a.m. |
| Registration Date |
March 1, 2021, 6:49 p.m. |
| Last Update |
Nov. 21, 2024, 12:59 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:emc:vipr_controller:*:*:*:*:*:*:*:* |
3.0.0.39 |
|
|
3.6.1.4 |
Related information, measures and tools
Common Vulnerabilities List