PT-2008-5551 · Vmware · Vmware Virtualcenter

Mark Woollatt · Published 2008-10-06 · Updated 2018-10-11 · CVE-2008-4278

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: VMware VirtualCenter version 2.5 before Update 3 build 119838

Description: The issue allows physically proximate attackers to steal a user's password when it contains unspecified special characters, as the password is displayed in cleartext.

Recommendations: For VMware VirtualCenter version 2.5 before Update 3 build 119838, update to Update 3 build 119838 or later to resolve the issue. As a temporary workaround, consider avoiding the use of special characters in passwords until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-4278

Affected Products

Vmware Virtualcenter

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2008-4278 · Security Note
• http://vmware.com/security/advisories/VMSA-2008-0016.html · Patch
• http://secunia.com/advisories/32180 · Vendor Advisory
• http://securitytracker.com/id?1020992 · Note
• http://marc.info/?l=bugtraq&m=122331139823057&w=2 · Note
• http://secunia.com/advisories/32179 · Note
• http://securityfocus.com/archive/1/497041/100/0/threaded · Note
• http://vupen.com/english/advisories/2008/2740 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45664 · Note
• http://securityfocus.com/bid/31569 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4278 · Note