CVE-2018-1240

Name of the Vulnerable Software and Affected Versions Dell EMC ViPR Controller versions after 3.0.0.38

Description The issue concerns an information exposure in the VRRP, where the cluster password is sent in plaintext through multicast due to an insecure default configuration in Linux's keepalived component. A malicious user with access to the vCloud subnet could potentially intercept the password and use it to take control of the cluster's virtual IP, leading to a denial of service on the affected system.

Recommendations For versions after 3.0.0.38, consider reconfiguring the VRRP to use a secure configuration, ensuring the cluster password is not sent in plaintext. As a temporary workaround, restrict access to the vCloud subnet where ViPR is deployed to minimize the risk of exploitation.