PT-2015-2314 · Vmware · Vmware Vcenter Server+1

Doug Mcleod · Publicado 2015-09-22 · Atualizado 2018-08-12 · CVE-2015-2342

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.0 through 5.0 u3e VMware vCenter Server versions 5.1 through 5.1 u3b VMware vCenter Server versions 5.5 through 5.5 u3 VMware vCenter Server versions 6.0 through 6.0 u1

Description The issue is related to the JMX RMI service in VMware vCenter Server, which does not properly restrict the registration of MBeans. This allows remote attackers to execute arbitrary code via the RMI protocol. The vulnerability is also associated with configuration errors of the JMX server, including the lack of authentication and encryption procedures when clients connect to the JMX server. Exploitation of the vulnerability can enable a remote attacker to execute arbitrary Java code.

Recommendations For versions 5.0 through 5.0 u3e, update to version 5.0 u3e or later. For versions 5.1 through 5.1 u3b, update to version 5.1 u3b or later. For versions 5.5 through 5.5 u3, update to version 5.5 u3 or later. For versions 6.0 through 6.0 u1, update to version 6.0 u1 or later. As a temporary workaround, consider restricting access to the JMX RMI service to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

BDU:2015-11676

CVE-2015-2342

ZDI-15-455

Produtos afetados

Vmware Vcenter

Vmware Vcenter Server

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_jmx_server.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/java_jmx_server.rb · Exploit
• 🔥 https://exploit-db.com/exploits/36101 · Exploit
• https://bdu.fstec.ru/vul/2015-11676 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2342 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2342 · Nota de Segurança
• https://7elements.co.uk/resources/technical-advisories/cve-2015-2342-vmware-vcenter-remote-code-execution · Nota
• http://securitytracker.com/id/1033720 · Nota
• http://seclists.org/fulldisclosure/2015/Oct/1 · Nota
• http://zerodayinitiative.com/advisories/ZDI-15-455 · Nota
• http://securityfocus.com/bid/76930 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-455 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2015-0007.html · Aviso do Fabricante