PT-2011-3370 · Vmware · Vsphere Client+2

Published 2011-05-09 · Updated 2011-05-26 · CVE-2011-1789

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware vCenter versions 4.0 through 4.0 Update 2 VMware vCenter versions 4.1 through 4.1 Update 0 VMware ESXi versions 4.x through 4.1 Update 0 VMware ESX versions 4.x through 4.1 Update 0

Description The issue is related to the self-extracting installer in the vSphere Client Installer package, which lacks a digital signature. This could allow remote attackers to spoof the software distribution via a Trojan horse installer.

Recommendations For VMware vCenter versions 4.0 through 4.0 Update 2, update to Update 3 or later. For VMware vCenter versions 4.1 through 4.1 Update 0, update to Update 1 or later. For VMware ESXi versions 4.x through 4.1 Update 0, update to 4.1 Update 1 or later. For VMware ESX versions 4.x through 4.1 Update 0, update to 4.1 Update 1 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-1789

Affected Products

Vmware Vcenter

Vmware Esxi

Vsphere Client

References · 5

• http://lists.vmware.com/pipermail/security-announce/2011/000137.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1789 · Security Note
• http://vmware.com/security/advisories/VMSA-2011-0008.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1789 · Note
• http://securitytracker.com/id?1025502 · Note