CVE-2017-15638 : Security Advisory and Response

SuSEfirewall2 package versions prior to 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 SP2; prior to 3.6.312.333-3.10.1 in SLE Desktop 12 SP3 and Server 12 SP3; prior to 3.6_SVNr208-2.18.3.1 in SLE Server 11 SP4; prior to 3.6.312-5.9.1 in openSUSE Leap 42.2; and prior to 3.6.312.333-7.1 in openSUSE Leap 42.3 may potentially enable attackers to bypass intended access restrictions on the portmap service. This vulnerability allows remote attackers to exploit the missing source net restriction for rpc services.

Understanding CVE-2017-15638

This CVE identifies a security vulnerability in the SuSEfirewall2 package that could be exploited by attackers to bypass access restrictions.

What is CVE-2017-15638?

The vulnerability in SuSEfirewall2 versions allows remote attackers to bypass intended access restrictions on the portmap service due to a missing source net restriction for rpc services.

The Impact of CVE-2017-15638

The vulnerability could potentially lead to unauthorized access to systems and services, compromising the security and integrity of the affected systems.

Technical Details of CVE-2017-15638

SuSEfirewall2 vulnerability details and affected systems.

Vulnerability Description

The SuSEfirewall2 package versions mentioned lack proper source net restrictions for rpc services, enabling remote attackers to bypass access restrictions on the portmap service.

Affected Systems and Versions

SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 SP2
SLE Desktop 12 SP3 and Server 12 SP3
SLE Server 11 SP4
openSUSE Leap 42.2 and 42.3

Exploitation Mechanism

Attackers can exploit the vulnerability by leveraging the missing source net restriction for rpc services, allowing them to bypass intended access restrictions on the portmap service.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2017-15638 vulnerability.

Immediate Steps to Take

Apply the necessary patches provided by the vendor promptly.
Implement network segmentation to limit the impact of potential attacks.
Monitor network traffic for any suspicious activity.

Long-Term Security Practices

Regularly update and patch all software and systems to address known vulnerabilities.
Conduct security assessments and audits to identify and remediate weaknesses.

Patching and Updates

Update the SuSEfirewall2 package to versions that address the vulnerability.