General Security Advisory
Severity
Critical
Description
A vulnerability which could be exploited in some OnApp transactions and under certain conditions allow an attacker to run arbitrary commands with root privileges on other Xen or KVM virtual servers within the same OnApp cloud.
Versions Affected: All known versions
Fixed Versions: Updated RPMs available for 5.0, 5.5, 6.0
Affected Components
All OnApp Control Panels managing XEN or KVM compute resources.
This vulnerability does not affect OnApp Control Panels which are only managing VMware vCloud Director or VMware vCenter environments, nor CDN only Control Panels.
Releases
The following releases include mitigation of the vulnerability, note that it is only necessary to update the OnApp Control Panel, not compute resources or backup servers.
- 6.0.0-196
- 5.5.0-93
- 5.0.0-88
Mitigation
Upgrade the OnApp Control Panel to the latest build of 5.0, 5.5 or 6.0 releases by following the documentation at:
- Mitigation for Clouds running 6.0 - upgrade to 6.0.0-196 version
- Mitigation for Clouds running 5.6-5.10 - upgrade to the latest 6.0 release
- Mitigation for Clouds running 5.5 - upgrade to 5.5.0-93 version
- Mitigation for Clouds running 5.1-5.4 - upgrade to the latest 5.5 release
- Mitigation for Clouds running 5.0 - upgrade to 5.0.0-88 version
- Mitigation does not require the upgrade of compute resources or backup servers.
- Take backups of any custom certificates located in the /etc/httpd/onapp.conf directory. During the upgrade, the system will auto-generate the default certificates.
- For OnApp versions prior to 5.0, we highly recommend updating to a supported release as soon as possible. Please, contact your account manager or OnApp support to discuss your options.
Workarounds
There are no feasible workarounds for this vulnerability, we strongly recommend to update.
Credits
The issue was identified by Shahar Zini at Skylight Cyber and responsibly reported to OnApp.
Revision History
Issue Date: 2019-06-06
Updated: 2019-06-07