PT-2010-2438 · Vmware · Vmware Server+2

Published 2010-04-01 · Updated 2010-04-28 · CVE-2010-0686

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VMware VirtualCenter versions 2.0.2 through 2.5 VMware Server version 2.0 VMware ESX versions 3.0.3 through 3.5

Description The issue allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability." This could potentially lead to unauthorized access or actions.

Recommendations For VMware VirtualCenter versions 2.0.2 through 2.5, consider restricting access to the WebAccess component until a fix is available. For VMware Server version 2.0, restrict the use of proxy-server functionality to minimize the risk of exploitation. For VMware ESX versions 3.0.3 through 3.5, avoid using the WebAccess feature in VMware VirtualCenter to prevent potential spoofing of request origins.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0686

Affected Products

Vmware Esxi

Vmware Server

Vmware Virtualcenter

References · 6

• http://securityfocus.com/bid/39037 · Patch
• http://lists.vmware.com/pipermail/security-announce/2010/000086.html · Vendor Advisory
• http://vmware.com/security/advisories/VMSA-2010-0005.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0686 · Security Note
• http://securitytracker.com/id?1023769 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0686 · Note