Security Remediation Notification
Security Risk in Provisioning Manager 4.50.18 Remedied
Akkadian Labs takes the security our software very seriously and we constantly work to make our products more secure. Recently, you may have seen an article, posted initially by
Rapid7, disclosing potential security risks in Akkadian Provisioning Manager 4.50.18. We appreciate the feedback from Rapid7, and ironically
Akkadian Labs had already remedied these issues in our current release. Unfortunately, we could not connect with Rapid7 before the article was published and are currently working with them to have it updated. Nonetheless, we want to ensure our customers understand these issues and how they could possibly impact older versions of Akkadian Provisioning Manager. It is important to understand the context of how these issues were discovered and what data can be exposed. Rapid7 could only access the system by interrupting the boot process, which requires access to VMWare console where the system must be rebooted, and the boot process interrupted. The other method is achieved by accessing the system via SSH, logging in with the “akkadianuser”, and exiting the Akkadian Appliance Manager menu. Both methods require an elevated level of access and therefore
do not pose a high risk. There are several approaches the customer can take to mitigate this security risk.
Recommended Solution: If running version 4.50 or earlier of Akkadian Provisioning Manager, upgrade to Akkadian Provisioning Manager 5.0+ with Akkadian Appliance Manager (CLI) 3.0.314-4a349e0 by deploying a new OVA.
Interim Mitigation:- Limit access to the VMWare console for the Akkadian appliance
- Change the “akkadianuser” password
- Limit SSH access to the Akkadian Appliance
If you require any assistance, please contact Akkadian Labs support by opening a ticket in our support portal or calling 1-800-818-4128.
Contact Support
