Detections
Analytics

VMSA-2011-0008 : VMware vCenter Server and vSphere Client security vulnerabilities

medium Nessus Plugin ID 53840

Language:

Synopsis

The remote VMware ESXi / ESX host is missing a security-related patch.

Description

a. vCenter Server Directory Traversal vulnerability

 A directory traversal vulnerability allows an attacker to remotely retrieve files from vCenter Server without authentication. In order to exploit this vulnerability, the attacker will need to have access to the network on which the vCenter Server host resides.

 In case vCenter Server is installed on Windows 2008 or Windows 2008 R2, the security vulnerability is not present.

 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2011-0426 to this issue.

b. vCenter Server SOAP ID disclosure

 The SOAP session ID can be retrieved by any user that is logged in to vCenter Server. This might allow a local unprivileged user on vCenter Server to elevate his or her privileges.

 VMware would like to thank Claudio Criscione for reporting this issue to us.

 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2011-1788 to this issue.

c. vSphere Client Installer package not digitally signed

 The digitally signed vSphere Client installer is packaged in a self-extracting installer package which is not digitally signed. As a result, when you run the install package file to extract and start installing, the vSphere Client installer may display a Windows warning message stating that the publisher of the install package cannot be verified.
 The vSphere Client Installer package of the following product versions is now digitally signed :

 vCenter Server 4.1 Update 1 vCenter Server 4.0 Update 3

 ESXi 4.1 Update 1 ESXi 4.0 with patch ESXi400-201103402-SG

 ESX 4.1 Update 1 ESX 4.0 with patch ESX400-201103401-SG

 An install or update of the vSphere Client from these releases will not present a security warning from Windows.
 Note: typically the vSphere Client will request an update if the existing client is pointed at a newer version of vCenter or ESX.

 VMware Knowledge Base article 1021404 explains how the unsigned install package can be obtained in an alternative, secure way for an environment with VirtualCenter 2.5, ESXi/ESX 3.5 or ESX 3.0.3.

 VMware would like to thank Claudio Criscione for reporting this issue to us.

 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2011-1789 to this issue.

Solution

Apply the missing patch.

See Also

http://lists.vmware.com/pipermail/security-announce/2011/000137.html

Plugin Details

Severity: Medium

ID: 53840

File Name: vmware_VMSA-2011-0008.nasl

Version: 1.21

Type: local

Published: 5/9/2011

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:vmware:esx:4.0, cpe:/o:vmware:esxi:4.0

Required KB Items: Host/local_checks_enabled, Host/VMware/release, Host/VMware/version

Exploit Ease: No known exploits are available

Patch Publication Date: 5/5/2011

Reference Information

CVE: CVE-2011-0426, CVE-2011-1788, CVE-2011-1789

BID: 47735, 47742, 47744

VMSA: 2011-0008