PT-2011-3370 · Vmware · Vsphere Client+2

Publicado 2011-05-09 · Atualizado 2011-05-26 · CVE-2011-1789

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware vCenter versions 4.0 through 4.0 Update 2 VMware vCenter versions 4.1 through 4.1 Update 0 VMware ESXi versions 4.x through 4.1 Update 0 VMware ESX versions 4.x through 4.1 Update 0

Description The issue is related to the self-extracting installer in the vSphere Client Installer package, which lacks a digital signature. This could allow remote attackers to spoof the software distribution via a Trojan horse installer.

Recommendations For VMware vCenter versions 4.0 through 4.0 Update 2, update to Update 3 or later. For VMware vCenter versions 4.1 through 4.1 Update 0, update to Update 1 or later. For VMware ESXi versions 4.x through 4.1 Update 0, update to 4.1 Update 1 or later. For VMware ESX versions 4.x through 4.1 Update 0, update to 4.1 Update 1 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-1789

Produtos afetados

Vmware Vcenter

Vmware Esxi

Vsphere Client

Referências · 5

• http://lists.vmware.com/pipermail/security-announce/2011/000137.html · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1789 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1789 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2011-0008.html · Aviso do Fabricante
• http://securitytracker.com/id?1025502 · Nota