PT-2008-4908 · Vmware · Vmware Virtualcenter

Published 2008-08-13 · Updated 2018-10-11 · CVE-2008-3514

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware VirtualCenter versions 2.0.2 before Update 5 VMware VirtualCenter versions 2.5 before Update 2

Description The issue allows remote attackers to determine valid user names by exploiting the client-side access control mechanism. This is done by enabling functionality in the GUI and then attempting to assign permissions to other system users.

Recommendations For versions 2.0.2 before Update 5, update to Update 5 or later. For versions 2.5 before Update 2, update to Update 2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3514

Affected Products

Vmware Virtualcenter

References · 12

• http://vupen.com/english/advisories/2008/2363 · Vendor Advisory
• http://secunia.com/advisories/31468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3514 · Security Note
• http://vmware.com/security/advisories/VMSA-2008-0012.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3514 · Note
• http://securityfocus.com/archive/1/495386/100/0/threaded · Note
• http://securityfocus.com/bid/30664 · Note
• http://securitytracker.com/id?1020693 · Note
• http://vmware.com/support/vi3/doc/releasenotes_vc202u5.html · Note
• http://insomniasec.com/advisories/ISVA-080812.1.htm · Note
• http://securityreason.com/securityalert/4150 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44425 · Note