Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

vCenter Server Appliance（和 PSC）6.5/6.0 针对要求本地访问的漏洞的权宜措施 (56154)

Last Updated: 6/13/2018Categories: SecurityTotal Views: 1Language:
Chinese (Simplified)English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

免责声明： 本文是 vCenter Server Appliance (and PSC) 6.5 / 6.0 Workaround for vulnerabilities which require local access (52312) 的翻译版本。 尽管我们会不断努力为本文提供最佳翻译版本，但本地化的内容可能会过时。 有关最新内容，请参见英文版本。

Purpose

vCenter Server Appliance 团队已调查要求本地访问（如本地特权升级、本地信息披露、本地拒绝服务等）的漏洞的影响，并确定可通过执行本文详述的步骤，保护该产品免受这些类型漏洞的影响。此权宜措施只是为了临时解决此问题。

警告

此解决办法仅适用于 vCenter Server Appliance（和 PSC）6.0 和 6.5。不要对其他 VMware 产品应用此权宜措施。

功能影响

应用此解决办法后，角色为“运维人员”的所有用户可能无法执行某些此前可以执行的操作。截至本文发表时，这是已知的唯一功能影响。

Resolution

要解决此问题，请使用以下方法之一。

解决办法 1

移除非 root 用户对设备 shell 的访问权限：

使用 SSH 会话以 root 用户身份登录到 vCenter Server Appliance。

使用以下命令备份 /etc/passwd 文件：

cp /etc/passwd /etc/passwd.bkup

要列出所有用户，请在设备 shell 中运行以下命令，并记录列出的用户：

user.list

使用以下命令在纯文本编辑器中打开 /etc/passwd 文件：

vi /etc/passwd

搜索具有运维人员访问权限的所有非 root 用户。

例如，用户测试有权访问 appliancesh。

test:x:1020:100:test:/home/test:/bin/appliancesh

将默认 shell 访问权限由 /bin/appliancesh 更改为 /sbin/nologin。

例如：

test:x:1020:100:test:/home/test:/sbin/nologin

保存并退出文件

要确认该解决办法，请运行以下步骤：

尝试使用 SSH 和具有“运维人员”角色的用户登录到 vCenter Server Appliance。

“运维人员”用户应该无法再登录。

要移除此解决办法，请运行以下步骤：

使用 SSH 会话以 root 用户身份登录到 vCenter Server Appliance。

使用以下命令备份 /etc/passwd 文件：

cp /etc/passwd /etc/passwd.modified.bkup

将所有“运维人员”用户的默认 shell 访问权限由 /sbin/nologin 更改为 /bin/appliancesh。

例如：

test:x:1020:100:test:/home/test:/bin/appliancesh

保存并退出文件

权宜措施 2

禁用 vCenter Server Appliance 上的 bash shell：

使用 SSH 会话以 root 用户身份登录到 vCenter Server Appliance。

通过运行以下命令更改为 appliancesh shell：

# appliancesh

使用 root 用户名和密码登录。

运行以下命令以禁用 bash shell：

shell.set –-enabled false

要验证解决办法，请运行以下步骤：

使用 SSH 会话以非 root 用户身份登录到 vCenter Server Appliance。

登录成功，且 appliancesh 已启动。

通过运行 shell 命令尝试切换到 Bash shell。

所有非 root 用户应该不能切换到 Bash shell。

注意：默认 shell 是设备 Shell，除非已手动将其更改为 Bash/Nologin。有关详细信息，请参见 Toggling the vCenter Server Appliance 6.x default shell (2100508)。

要移除此解决办法，请运行以下步骤：

使用 SSH 会话以 root 用户身份登录到 vCenter Server Appliance。

运行以下命令以启用 bash shell：

shell.set –-enabled true

此权宜措施可有效解决的示例漏洞：

CVE-2017-5753

CVE-2017-5715

CVE-2017-5754

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)English

Attachments

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vCenter Server Appliance

Related Versions:

VMware vCenter Server Appliance 6.5.x

VMware vCenter Server Appliance 6.0.x

Support Assistant