CVE-2018-1276: Windows2012R2 stemcell exposes IaaS metadata on vSphere

Severity

Medium

Vendor

Cloud Foundry Foundation

Affected Cloud Foundry Products and Versions

• You are using Windows 2012R2 stemcells versions prior to 1200.17

Description

Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can execute crafted commands to read the IaaS metadata from the VM, which may contain BOSH credentials.

Mitigation

Users of affected versions should apply the following mitigations or upgrades:

• Releases that have fixed this issue include:
  • Windows 2012R2 stemcells version 1200.17

Credit

This issue was responsibly reported by the BOSH Windows team.

History

2018-05-16: Initial vulnerability report published.