Kubernetes, which offers a container orchestration system widely used by DevOps practitioners, announced the discovery of CVE-2019-11246 , a high-severity vulnerability affecting the command-line interface kubectl ,during an ongoing third-party security audit. Exploitation of this vulnerability could lead to a directory traversal — allowing an attacker to use a malicious container to create or replace files in a user’s workstation.
Incidentally, the new flaw emerged due to incomplete updates for CVE-2019-1002101 , a related vulnerability which was disclosed back in March.
The details of CVE-2019-11246 are similar to the previously-patched CVE-2019-1002101. However, due to the incomplete nature of the update, some flaws remained, resulting in the discovery of the new exploit method.
CVE-2019-11246 specifically involves kubectl cp, the command responsible for copying files between containers and user machines. As part of its copying routine, Kubernetes creates an archive by running a tar binary inside the container. It will then copy the binary over the network, after which it will be unpacked on the user’s machine by kubectl.
An attacker could exploit this by using a malicious tar binary to write files to any path on the target machine whenever kubectl cp is called. This could result in the adding of malicious files or overwriting of existing ones to compromise the environment.
CVE-2019-11246 is a client-side vulnerability, and thus requires user interaction to be exploited.
Users can check whether their client version is vulnerable to the bug by running kubectl version –client. Client versions older than 1.12.9, 1.13.6, and 1.14.2 are vulnerable. Users should update their clients at the soonest possible time.
Best practices to defend against possible attacks that exploit CVE-2019-11246
To protect enterprise resources from attackers aiming to take advantage of vulnerabilities such as CVE-2019-11246, organizations should implement the following best practices:
Security solutions can help prevent the potential impact of vulnerabilities in Kubernetes. One example is Trend Micro™ Hybrid Cloud Security , which provides threat defense for safeguarding runtime physical, virtual, and cloud workloads, and containers. It also scans container images during development phases. It provides powerful, streamlined, and automated security within the organization’s DevOps pipeline and delivers multiple XGen™ threat defense techniques for protecting runtime physical, virtual, and cloud workloads.
It also adds protection for containers via the Deep Security™ solution and Deep Security Smart Check , which scans container images for malware and vulnerabilities at different stages of development to detect threats.
Like it? Add this infographic to your site:1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
In the first half of this year, cybersecurity strongholds were surrounded by cybercriminals waiting to pounce at the sight of even the slightest crack in defenses to ravage valuable assets. View the report
The upheavals of 2020 challenged the limits of organizations and users, and provided openings for malicious actors. A robust cybersecurity posture can help equip enterprises and individuals amid a continuously changing threat landscape. View the 2020 Annual Cybersecurity Report
buying dumps unicc carding
Written By