CVE-2018-5486: High severity NetApp OnCommand Unified Manager vulnerability
NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable JDWP on NetApp OnCommand Unified Manager for Linux instances running versions 7.2 through 7.3, since JDWP is enabled and allows unauthorized local attackers to execute arbitrary code.
NetApp OnCommand Unified Manager for Linux Java Debug Wire Protocol (JDWP) = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5486?
CVE-2018-5486 has a critical severity rating due to the potential for unauthorized local code execution.
How do I fix CVE-2018-5486?
To fix CVE-2018-5486, disable the Java Debug Wire Protocol (JDWP) settings in your NetApp OnCommand Unified Manager configuration.
Which versions of NetApp OnCommand Unified Manager are affected by CVE-2018-5486?
CVE-2018-5486 affects NetApp OnCommand Unified Manager versions 7.2 through 7.3.
What types of attacks does CVE-2018-5486 facilitate?
CVE-2018-5486 facilitates unauthorized local attacks, allowing attackers to execute arbitrary code on the affected system.
Is the Linux kernel vulnerable in CVE-2018-5486?
No, the Linux kernel itself is not vulnerable to CVE-2018-5486; the vulnerability specifically affects NetApp OnCommand Unified Manager.