vRealize Automation Appliance 7.x Workaround for vulnerabilities which require local access

Products

• VMware Aria Suite

Issue/Introduction

The vRealize Automation team has investigated the impact of vulnerabilities which require local access (such as local privilege escalation, local information disclosures, local denial of service, etc.) and determined that the product can be protected from these types of vulnerabilities by performing the steps detailed in this article. This workaround is meant to be a temporary solution only.

Warning:

• This workaround is applicable ONLY to vRealize Automation Appliance 7.x. Do not apply this workaround to other VMware products.
• This workaround must be applied to all vRealize Automation appliances in High Availability deployments.

Functionality Impacts:
Workaround 1: All non-root custom users identified in the resolution section may not be able to perform actions that were previously possible while the workaround is in place due their disabled SSH access.

Workaround 2: All users, including root, may not be able to perform actions that were previously possible while the workaround is in place due to disabled SSH service.

Environment

VMware vRealize Automation 7.5.x
VMware vRealize Automation 7.3.x
VMware vRealize Automation 7.2.x
VMware vRealize Automation 7.6.x
VMware vRealize Automation 7.4.x

Resolution

Please see the Workaround section.

Workaround:
To implement the workaround for perform one of the following:

Workaround 1

Remove access to the appliance shell for non-root users:

1. Login to the vRealize Automation Appliance with a SSH session and the root user.
2. Backup the /etc/passwd file with this command:

cp /etc/passwd /etc/passwd.bkup

3. Download the 52377_identify_non_root_users.py.gz script.
4. Extract and transfer the script to the appliance.
5. Run this command to make sure that the script is executable:

chmod 755 identify_non_root_users.py

6. To list all the non-root custom users, run this command and take note of the users listed

python identify_non_root_users.py 
 

If there are no users listed in the console, there are no users to disable.

7. Open the /etc/passwd file with a plain text editor using this command:

vi /etc/passwd

8. Search for all non-root users identified in step 6.

For example the user test has access to bash.
 

test:x:1020:100:test:/home/test:/bin/bash

9. Change the default shell access from /bin/bash to /sbin/nologin.

For example:

test:x:1020:100:test:/home/test:/sbin/nologin

10. Save and exit the file.

To confirm that the workaround works, run these steps:

1. Attempt to log into vRealize Automation Appliance using SSH and with a non-root user from step 6.
2. Non-root users should no longer be able to log in.

To remove the workaround, run these following steps:

1. Login to the vRealize Automation Appliance with an SSH session and the root user.
2. Backup the /etc/passwd file by with this command:

cp /etc/passwd /etc/passwd.modified.bkup

3. Change the default shell access from /sbin/nologin to /bin/bash for all the non-root users.

For example:

test:x:1020:100:test:/home/test:/bin/bashsh

4. Save and Exit the file

Workaround 2

Disable the SSH shell on vRealize Automation Appliance:

1. Login to the vRealize Automation Appliance with an SSH session and the root user.
2. Once logged in, run these commands:
   • /etc/init.d/sshd stop
   • chkconfig sshd off

To validate the workaround run these following steps:

1. Try to log in from any other machine using SSH to the appliance.
2. It should prompt that connection is refused. 

To remove the workaround run these steps:

1. Log in from the vSphere console as root.
2. Start the ssh service with the command /etc/init.d/sshd start.
3. Run the command chkconfig sshd on.

Example vulnerabilities that this workaround will be effective against:

• CVE-2017-5753
• CVE-2017-5715
• CVE-2017-5754

Additional Information

简体中文：vRealize Automation 设备 7.2/7.3/7.4 针对要求本地访问的漏洞的解决办法