Detections
Analytics
VMware vCenter Server Appliance BlazeDS AMF3 RCE (VMSA-2017-0007)
critical Nessus Plugin ID 99474
Language:
Synopsis
A virtualization appliance installed on the remote host is affected by a remote code execution vulnerability.Description
The version of VMware vCenter Server Appliance installed on the remote host is 6.0 prior to Update 3b or 6.5 prior to Update c. It is, therefore, affected by a flaw in FlexBlazeDS when processing AMF3 messages due to allowing the instantiation of arbitrary classes when deserializing objects. An unauthenticated, remote attacker can exploit this, by sending a specially crafted Java object, to execute arbitrary code.Solution
Upgrade to VMware vCenter Server Appliance 6.0 Update 3b / 6.5 Update c or later. Alternatively, apply the vendor-supplied workaround.See Also
https://www.vmware.com/security/advisories/VMSA-2017-0007.html
http://www.nessus.org/u?1bb48b81
Plugin Details
Severity: Critical
ID: 99474
File Name: vmware_vcenter_server_appliance_vmsa-2017-0007.nasl
Version: 1.6
Type: local
Family: Misc.
Published: 4/19/2017
Updated: 11/13/2019
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2017-5641
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:vmware:vcenter_server_appliance
Required KB Items: Host/VMware vCenter Server Appliance/Version, Host/VMware vCenter Server Appliance/Build
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/13/2017
Vulnerability Publication Date: 4/4/2017
Reference Information
CVE: CVE-2017-5641
BID: 97383