A vulnerability was found in BOSH Director VM. It has been declared as critical. Affected by this vulnerability is some unknown processing of the component URL Matching. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.

The bug was discovered 06/13/2016. The weakness was shared 05/25/2017 (Website). It is possible to read the advisory at pivotal.io. This vulnerability is known as CVE-2016-4435 since 05/02/2016. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 346 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 3232.6 or 3146.13 eliminates this vulnerability.

Productinfo

Vendor

• BOSH

Name

• Director VM

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion