CVE-2019-11288 : Security Advisory and Response

Before Pivotal tc Server versions 3.2.19 and 4.0.10, and Pivotal tc Runtimes versions 7.0.99.B, 8.5.47.A, and 9.0.27.A, a local attacker could exploit the JMX Socket Listener to carry out a man-in-the-middle attack, intercepting user credentials.

Understanding CVE-2019-11288

This CVE involves a local privilege escalation vulnerability in Pivotal tc Server and tc Runtimes.

What is CVE-2019-11288?

In Pivotal tc Server and tc Runtimes, a flaw allowed a local attacker to manipulate the RMI registry, intercepting user credentials and gaining control over the affected instance.

The Impact of CVE-2019-11288

The vulnerability had a CVSS base score of 7.3, with high impacts on confidentiality, integrity, and availability, enabling attackers to escalate privileges locally.

Technical Details of CVE-2019-11288

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability allowed a local attacker to exploit the JMX Socket Listener to perform a man-in-the-middle attack, compromising user credentials and taking control of the tc Runtime instance.

Affected Systems and Versions

Pivotal tc Server 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10
Pivotal tc Runtimes 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A

Exploitation Mechanism

The attacker, without access to the tc Runtime process or configuration files, could manipulate the RMI registry through the JMX Socket Listener to intercept user credentials.

Mitigation and Prevention

Protecting systems from CVE-2019-11288 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply patches provided by Pivotal to fix the vulnerability.
Disable the JMX Socket Listener if not essential for operations.
Monitor network traffic for any suspicious activities.

Long-Term Security Practices

Regularly update and patch all software components.
Implement strong access controls and privilege management.
Conduct security training to educate users on best practices.

Patching and Updates

Pivotal released patches for affected versions to address the vulnerability and improve system security.