Lucene search

EclipseCVE-2017-7649

HistorySep 11, 2017 - 4:29 p.m.

CVE-2017-7649

2017-09-1116:29:00

CWE-287

eclipse

web.nvd.nist.gov

cve-2017-7649

kura

network security

firewall setup

unauthorized access

equinox

ipv6

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

The network enabled distribution of Kura before 2.1.0 takes control over the device’s firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox “exec” command. As the process is running as “root” full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.

Affected configurations

Nvd

Node

eclipsekuraRange≤2.0.2

VendorProductVersionCPE
eclipsekura*cpe:2.3:a:eclipse:kura:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eclipse	kura	*	cpe:2.3:a:eclipse:kura::::::::

CNA Affected

[
  {
    "product": "Eclipse Kura Installer",
    "vendor": "Eclipse Foundation",
    "versions": [
      {
        "lessThan": "2.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

bugs.eclipse.org/bugs/show_bug.cgi?id=514681

github.com/eclipse/kura/issues/956

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

57.0%

JSON

Related for CVE-2017-7649