PT-2006-3429 · Vmware · Vmware Esx Server

Published 2006-07-31 · Updated 2018-10-30 · CVE-2006-2481

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware ESX Server versions 2.0.x before 2.0.2 VMware ESX Server versions 2.x before 2.5.2 patch 4

Description The issue allows attackers to gain privileges by obtaining authentication credentials stored in base 64 encoded format in the vmware.mui.kid and vmware.mui.sid cookies. This can be achieved through attacks such as cross-site scripting.

Recommendations For versions 2.0.x before 2.0.2, update to version 2.0.2 or later. For versions 2.x before 2.5.2 patch 4, apply patch 4 or later to version 2.5.2.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2006-2481

Affected Products

Vmware Esx Server

References · 9

• 🔥 https://exploit-db.com/exploits/28312 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2481 · Security Note
• http://vupen.com/english/advisories/2006/3075 · Vendor Advisory
• http://secunia.com/advisories/21230 · Vendor Advisory
• http://corsaire.com/advisories/c060512-001.txt · Vendor Advisory
• http://securityfocus.com/archive/1/441825/100/100/threaded · Note
• http://securityfocus.com/bid/19249 · Note
• http://kb.vmware.com/kb/2118366 · Note
• http://securityfocus.com/archive/1/441728/100/100/threaded · Note