[German]Brief note for administrators who use the load balancer LoadMaster from Progress Kemp. The provider issued a warning about a vulnerability CVE-2024-7591 in August 2024. Kemp will publish details later. Administrators using the product should update immediately.
Advertising
What is Progress Kemp?
Progress Kemp offers the LoadMaster load balancer, which is designed to provide load balancing in networks. In its simplest form, a load balancer offers the option of forwarding application users to the most powerful and accessible server.
Vulnerability CVE-2024-7591 in LoadMaster
A German blog reader has informed me that there is probably a security problem with LoadMaster. However, the Progress Kemp LoadMaster team has "recently" identified a vulnerability (CVE-2024-7591) in LoadMaster. The following product versions are affected:
- LoadMaster 7.2.60.0 and previous versions
- ECS Connection Manager 7.2.60.0 and previous versions
- Multi-Tenant Hypervisor 7.1.35.11 and previous versions
The vulnerability allows unauthenticated remote attackers to access the LoadMaster management interface. All that is required is to send an appropriately crafted HTTP request to allow the execution of arbitrary system commands.
This vulnerability has been closed by sanitizing user input from appropriate requests to mitigate the execution of arbitrary system commands. While the security team states that they have not received any reports of this vulnerability being exploited and the vendor is not aware of any direct impact to customers.
Update products
The provider has provided security updates for the affected products as of August 19, 2024. Customers should install the add-on package as soon as possible. The add-on package can be installed on any version of LoadMaster, even if support for the device has expired. The product Multi-Tenant LoadMaster (LoadMaster MT) is affected as follows:
Advertising
- The individual instantiated LoadMaster VNFs are vulnerable and must be patched with the add-on as soon as possible.
- It should be noted that the MT hypervisor or manager node is also vulnerable and must be patched as soon as possible with the above add-on.
Customers can download the add-on via a link provided by the vendor in a security advisory and install it according to the instructions in this knowledge base article.
The vendor has provided three links, but they all point to the above URL with the add-on download.
A German blog reader mentioned, that administrators should also install the latest Firmware updates available here.
I will add the details here after the vendor has published the information promised on September 3, 2024.
Advertising
