CVE-2015-6927

Low

Description

vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.

SeverityLow

CVSS3.6

Exploit probability—

ProductOpenvz Vzctl

PublishedSep 28, 2015

First seenSep 28, 2015

How to fix

Vendor advisories

security.gentoo.org/glsa/201701-30

Affected products

Product	Affected versions	Fixed in
openvz vzctl	v ≤ 4.9.3	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.