CVE-2018-1240
High
Description
Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.
SeverityHigh
CVSS8.0
Exploit probability—
ProductEmc Vipr Controller
PublishedApr 18, 2018
First seenApr 18, 2018
How to fix
Update
- emc vipr_controller3.6.1.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emc vipr_controller | 3.0.0.39 ≤ v < 3.6.1.4 | 3.6.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.