Vulnerability identifier: #VU6610

Vulnerability risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2637

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Red Hat OpenStack
Server applications / Other server solutions

Vendor: Red Hat Inc.

Description
The vulnerability allows a remote unauthenticated attacker to bypass authentication on a targeted system.

The weakness exists due to the improper authentication and encryption standards that are set by default when the libvirtd component is deployed by the affected software. A remote attacker create a TCP connection to a compute host IP address, gain unauthorized access to the system that may allow to gain control of the host.

Successful exploitation of the vulnerability results in unauthorized access to the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Red Hat OpenStack: 10.0

---

External links
http://access.redhat.com/security/cve/CVE-2017-2637

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.