Multiple vulnerabilities in VMware vSphere Data Protection

1) OS command injection

EUVDB-ID: #VU15988

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11066

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote unauthenticated attacker can inject and execute arbitrary shell commands to compromise vulnerable system.

Mitigation

The vulnerability has been fixed in the versions 6.0.9, 6.1.10.

Vulnerable software versions

vSphere Data Protection: 6.0 - 6.1.9

External links

http://www.vmware.com/security/advisories/VMSA-2018-0029.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Open redirect

EUVDB-ID: #VU15989

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11067

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: No

Description

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Mitigation

The vulnerability has been fixed in the versions 6.0.9, 6.1.10.

Vulnerable software versions

vSphere Data Protection: 6.0 - 6.1.9

External links

http://www.vmware.com/security/advisories/VMSA-2018-0029.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) OS command injection

EUVDB-ID: #VU15990

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11076

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote administrative attacker to execute arbitrary shell commands on the target system.

The vulnerability exists in the 'getlogs' troubleshooting utility in VDP due to insufficient validation of user-supplied input. A remote attacker can inject and execute arbitrary shell commands under root privilege.

Mitigation

The vulnerability has been fixed in the versions 6.0.9, 6.1.9.

Vulnerable software versions

vSphere Data Protection: 6.0 - 6.1.8

External links

http://www.vmware.com/security/advisories/VMSA-2018-0029.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU15991

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11077

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to VDP Java management console’s SSL/TLS private key may be leaked in the VDP Java management client package. A remote attacker can access arbitrary data that may be used by an unauthenticated attacker on the same data-link layer to initiate a MITM attack on management console users.

Mitigation

The vulnerability has been fixed in the versions 6.0.9, 6.1.10.

Vulnerable software versions

vSphere Data Protection: 6.0 - 6.1.9

External links

http://www.vmware.com/security/advisories/VMSA-2018-0029.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.