Carbon Black Advisory: Response to CVE-2016-5195 (Dirty Cow) Vulnerability

[#1]

Version

Cb Response 5.x

Topic

How to fix the CVE-2016-5195 vulnerability on a Cb Response server.

Steps

Cb Response 5.2 supports the latest version of RHEL or CentOS 6.4 to 6.8 (64bit) which has patched the "Dirty Cow" vulnerability CVE-2016-5195. 5.0 supports RHEL or CentOS 6.4­6.6 (64bit). 5.1 supports RHEL or CentOS 6.4­6.7 (64bit). You can review the server sizing guide for more information for what version of Linux your version of Cb Response supports:

Carbon Black Response v5.2 - Server Sizing Guide

Carbon Black Enterprise Response v5.1.1 - Server Sizing Guide

Carbon Black 5.0 - Enterprise Server Sizing Guide.pdf

Important Note(s)

This vulnerability is a privilege escalation that impacts specific kernels, not specific products. The Cb Response product itself does not make it remotely exploitable, while local non privileged user access and a vulnerable kernel does.