PT-2013-3130 · Vmware · Vmware Esxi+5

Publicado 2013-02-15 · Atualizado 2013-02-15 · CVE-2013-1405

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 4.0 through 4.1 before Update 3a VMware VirtualCenter version 2.5 VMware vSphere Client versions 4.0 through 4.1 before Update 3a VMware VI-Client version 2.5 VMware ESXi versions 3.5 through 4.1 VMware ESX versions 3.5 through 4.1

Description The issue is related to the improper implementation of the management authentication protocol in the affected software. This allows remote servers to execute arbitrary code or cause a denial of service due to memory corruption via unspecified vectors.

Recommendations For VMware vCenter Server versions 4.0 through 4.1 before Update 3a, update to a version that includes Update 3a or later. For VMware VirtualCenter version 2.5, consider upgrading to a newer version of vCenter Server. For VMware vSphere Client versions 4.0 through 4.1 before Update 3a, update to a version that includes Update 3a or later. For VMware VI-Client version 2.5, consider upgrading to a newer version of vSphere Client. For VMware ESXi versions 3.5 through 4.1, update to a version later than 4.1. For VMware ESX versions 3.5 through 4.1, update to a version later than 4.1.

Correção

DoS

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-1405

Produtos afetados

Vmware Vcenter

Vmware Esxi

Vmware Vi-Client

Vmware Virtualcenter

Vmware Vcenter Server

Vmware Vsphere Client

Referências · 3

• http://vmware.com/security/advisories/VMSA-2013-0001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-1405 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1405 · Nota