PT-2006-6651 · Vmware · Vmware Virtualcenter Client

Published 2006-11-21 · Updated 2018-10-17 · CVE-2006-5990

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions VMWare VirtualCenter client versions 1.4.x through 1.4.1 (before Patch 1, Build 33425) VMWare VirtualCenter client versions 2.x through 2.0.1 (before Patch 1, Build 33643)

Description The issue allows remote malicious servers to spoof valid servers via a man-in-the-middle attack when server certificate verification is enabled. This occurs because the client does not verify the server's X.509 certificate when creating an SSL session.

Recommendations For VMWare VirtualCenter client versions 1.4.x through 1.4.1 (before Patch 1, Build 33425), apply Patch 1 (Build 33425) to resolve the issue. For VMWare VirtualCenter client versions 2.x through 2.0.1 (before Patch 1, Build 33643), apply Patch 1 (Build 33643) to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-5990

Affected Products

Vmware Virtualcenter Client

References · 10

• http://secunia.com/advisories/23053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5990 · Security Note
• http://vmware.com/download/vi/vc-201-200611-patch.html · Patch
• http://vupen.com/english/advisories/2006/4655 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30477 · Note
• http://kb.vmware.com/kb/4646606 · Note
• http://securityfocus.com/archive/1/452275/100/0/threaded · Note
• http://securityfocus.com/bid/21231 · Note
• http://securitytracker.com/id?1017270 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5990 · Note