PT-2011-1384 · Vmware · Vmware Vcenter Server+1

Claudio Criscione · Published 2011-02-16 · Updated 2018-10-10 · CVE-2010-2928

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware vCenter Server version 4.1 before Update 1

Description The issue concerns the storage of log-on credentials in a configuration file by the vCenter Tomcat Management Application. This allows local users to gain privileges by reading the file, potentially leading to unauthorized access.

Recommendations For VMware vCenter Server version 4.1 before Update 1, apply Update 1 to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2010-2928

Affected Products

Vmware Vcenter

Vmware Vcenter Server

References · 8

• http://vmware.com/security/advisories/VMSA-2011-0003.html · Vendor Advisory
• http://secunia.com/advisories/43307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2928 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2928 · Note
• http://vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html · Note
• http://securityreason.com/securityalert/8079 · Note
• http://securityfocus.com/archive/1/516397/100/0/threaded · Note
• http://osvdb.org/70859 · Note