PT-2009-6144 · Apache+2 · Apache Http Server+1

Publicado 2009-11-10 · Atualizado 2017-08-17 · CVE-2009-3923

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Virtual Desktop Infrastructure (VDI) version 3.0, specifically VirtualBox versions 2.0.8 and 2.0.10

Description The issue concerns the VirtualBox web service in Sun Virtual Desktop Infrastructure (VDI) 3.0, which does not require authentication. This allows remote attackers to obtain unspecified access by sending requests to an Apache HTTP Server.

Recommendations For VirtualBox versions 2.0.8 and 2.0.10 in Sun Virtual Desktop Infrastructure (VDI) 3.0, consider implementing authentication for the VirtualBox web service to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-3923

Produtos afetados

Apache Http Server

Virtualbox

Referências · 6

• http://sunsolve.sun.com/search/document.do?assetkey=1-66-268328-1 · Aviso do Fabricante
• http://securityfocus.com/bid/36917 · Correção
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-03-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3923 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54136 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3923 · Nota