PT-2010-5540 · Vmware · Vmware Esxi

Published 2010-12-22 · Updated 2018-10-10 · CVE-2010-4573

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware ESXi version 4.1

Description The issue concerns the Update Installer in VMware ESXi, which fails to properly configure the SFCB authentication mode when a modified sfcb.cfg is present. This allows remote attackers to gain access using any username and password.

Recommendations For VMware ESXi version 4.1, ensure proper configuration of the SFCB authentication mode to prevent unauthorized access. As a temporary workaround, consider restricting access to the SFCB service until a proper configuration can be applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-4573

Affected Products

Vmware Esxi

References · 10

• http://secunia.com/advisories/42591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4573 · Security Note
• http://vupen.com/english/advisories/2010/3303 · Vendor Advisory
• http://vmware.com/security/advisories/VMSA-2010-0020.html · Vendor Advisory
• http://securityfocus.com/archive/1/515420/100/0/threaded · Note
• http://kb.vmware.com/kb/1031761 · Note
• http://securityfocus.com/bid/45543 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4573 · Note
• http://lists.vmware.com/pipermail/security-announce/2010/000114.html · Note
• http://securitytracker.com/id?1024917 · Note