PT-2009-6144 · Apache+2 · Apache Http Server+1

Published 2009-11-10 · Updated 2017-08-17 · CVE-2009-3923

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sun Virtual Desktop Infrastructure (VDI) version 3.0, specifically VirtualBox versions 2.0.8 and 2.0.10

Description The issue concerns the VirtualBox web service in Sun Virtual Desktop Infrastructure (VDI) 3.0, which does not require authentication. This allows remote attackers to obtain unspecified access by sending requests to an Apache HTTP Server.

Recommendations For VirtualBox versions 2.0.8 and 2.0.10 in Sun Virtual Desktop Infrastructure (VDI) 3.0, consider implementing authentication for the VirtualBox web service to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-3923

Affected Products

Apache Http Server

Virtualbox

References · 6

• http://sunsolve.sun.com/search/document.do?assetkey=1-66-268328-1 · Vendor Advisory
• http://securityfocus.com/bid/36917 · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-21-141481-03-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3923 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54136 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3923 · Note