Blue Coat Malware Analysis Appliance/Malware Analyzer G2 Virtual Machine access control

Summaryinfo

A vulnerability labeled as critical has been found in Blue Coat Malware Analysis Appliance and Malware Analyzer G2. The affected element is an unknown function of the component Virtual Machine. Executing a manipulation can lead to access control. The identification of this vulnerability is CVE-2015-4523. The attack can only be executed locally. Furthermore, there is an exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Blue Coat Malware Analysis Appliance and Malware Analyzer G2 (Anti-Malware Software) (the affected version unknown). This vulnerability affects an unknown part of the component Virtual Machine. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protection mechanism and consequently write to arbitrary files, cause a denial of service (host reboot or reset to factory defaults), or execute arbitrary code via vectors related to saving files during analysis.

The bug was discovered 06/30/2015. The weakness was shared 09/11/2017 (Website). The advisory is available at bto.bluecoat.com. This vulnerability was named CVE-2015-4523 since 06/11/2015. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 804 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (34334). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Anti-Malware Software

Vendor

• Blue Coat

Name

• Malware Analysis Appliance
• Malware Analyzer G2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion