PT-2015-3763 · Vmware+1 · Vmware Vsphere Data Protection+3

Publicado 2015-02-01 · Atualizado 2017-08-29 · CVE-2014-4632

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware vSphere Data Protection (VDP) versions 5.1, 5.5 through 5.5.8, 5.8 through 5.8.0 EMC Avamar Data Store (ADS) versions 6.x EMC Avamar Virtual Edition (AVE) versions 6.x, 7.0.x

Description The issue allows man-in-the-middle attackers to spoof servers and bypass intended backup and restore access restrictions via a crafted X.509 certificate, due to improper verification of these certificates from vCenter Server SSL servers.

Recommendations For VMware vSphere Data Protection (VDP) versions 5.1, update to version 5.5.9 or later. For VMware vSphere Data Protection (VDP) versions 5.5 through 5.5.8, update to version 5.5.9 or later. For VMware vSphere Data Protection (VDP) versions 5.8 through 5.8.0, update to version 5.8.1 or later. For EMC Avamar Data Store (ADS) versions 6.x, update to a version that properly verifies X.509 certificates. For EMC Avamar Virtual Edition (AVE) versions 6.x, 7.0.x, update to a version that properly verifies X.509 certificates.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-4632

Produtos afetados

Emc Avamar Data Store

Avamar Virtual Edition

Vmware Vsphere Data Protection

Vcenter Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-4632 · Nota de Segurança
• http://securitytracker.com/id/1031664 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100866 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2015-01/0154.html · Nota
• http://vmware.com/security/advisories/VMSA-2015-0002.html · Aviso do Fabricante