CVE-2016-3643: SolarWinds Virtualization Manager Privilege Escalation Vulnerability
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."
Other sources
SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Review /etc/sudoers and all files in /etc/sudoers.d on the Virtualization Manager host. Using visudo, remove or modify any entries that allow users to run arbitrary commands via sudo (for example entries that effectively permit 'sudo cat /etc/passwd' or use ALL/NOPASSWD for non-administrative accounts). Replace broad entries with least-privilege, command-specific sudo rules and validate changes with visudo before saving.
sudoers (sudo configuration on SolarWinds Virtualization Manager host) sudo rule entries = remove or restrict entries that allow execution of arbitrary commands via sudo (e.g., entries that permit ALL or NOPASSWD for untrusted users); grant only specific permitted commands - Operational
Audit recent sudo usage on the Virtualization Manager host (check sudo logs in /var/log/auth.log, /var/log/secure, or the system journal) for evidence of misuse (e.g., unexpected sudo invocations such as 'sudo cat /etc/passwd'). Investigate any suspicious activity and remediate affected accounts or sessions (revoke inappropriate sudo privileges and lock or disable compromised accounts as necessary).
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3643?
CVE-2016-3643 has a moderate severity rating due to the potential for privilege escalation.
How do I fix CVE-2016-3643?
To fix CVE-2016-3643, ensure proper configuration of the sudoers file and restrict access appropriately.
Who is affected by CVE-2016-3643?
CVE-2016-3643 affects users of SolarWinds Virtualization Manager versions 6.3.1 and earlier.
What type of vulnerability is CVE-2016-3643?
CVE-2016-3643 is a local privilege escalation vulnerability resulting from a misconfiguration of sudo.
Can CVE-2016-3643 be exploited remotely?
No, CVE-2016-3643 requires local access to the system for exploitation.