The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.

The remote VMware ESXi host is version 5.5 prior to build 3029944. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

The remote VMware ESXi host is version 5.1 prior to build 3021178. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

The remote VMware ESXi host is version 5.0 prior to build 3021432. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

The remote VMware ESXi host is affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

The VMware vCenter Server installed on the remote host is affected by the following vulnerabilities :

  - A flaw exists in the vpxd service due to improper     sanitization of long heartbeat messages. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2015-1047)

  - A flaw exists due to an insecurely configured and     remotely accessible JMX RMI service. An unauthenticated,     remote attacker can exploit this, via an MLet file, to     execute arbitrary code on the vCenter server with the     same privileges as the web server. (CVE-2015-2342)

ID	Name	Product	Family	Severity
86947	VMware ESXi 5.5 < Build 3029944 OpenSLP RCE (VMSA-2015-0007)	Nessus	Misc.	high
86946	VMware ESXi 5.1 < Build 3021178 OpenSLP RCE (VMSA-2015-0007)	Nessus	Misc.	high
86945	VMware ESXi 5.0 < Build 3021432 OpenSLP RCE (VMSA-2015-0007)	Nessus	Misc.	high
86254	VMSA-2015-0007 : VMware vCenter and ESXi updates address critical security issues	Nessus	VMware ESX Local Security Checks	high
86255	VMware vCenter Multiple Vulnerabilities (VMSA-2015-0007)	Nessus	Misc.	critical

Detections

Analytics

CVE-2015-2342

critical

Tenable Plugins

high

high

high

high

critical