PT-2013-3130 · Vmware · Vmware Esxi+5

Published 2013-02-15 · Updated 2013-02-15 · CVE-2013-1405

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 4.0 through 4.1 before Update 3a VMware VirtualCenter version 2.5 VMware vSphere Client versions 4.0 through 4.1 before Update 3a VMware VI-Client version 2.5 VMware ESXi versions 3.5 through 4.1 VMware ESX versions 3.5 through 4.1

Description The issue is related to the improper implementation of the management authentication protocol in the affected software. This allows remote servers to execute arbitrary code or cause a denial of service due to memory corruption via unspecified vectors.

Recommendations For VMware vCenter Server versions 4.0 through 4.1 before Update 3a, update to a version that includes Update 3a or later. For VMware VirtualCenter version 2.5, consider upgrading to a newer version of vCenter Server. For VMware vSphere Client versions 4.0 through 4.1 before Update 3a, update to a version that includes Update 3a or later. For VMware VI-Client version 2.5, consider upgrading to a newer version of vSphere Client. For VMware ESXi versions 3.5 through 4.1, update to a version later than 4.1. For VMware ESX versions 3.5 through 4.1, update to a version later than 4.1.

Fix

DoS

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-1405

Affected Products

Vmware Vcenter

Vmware Esxi

Vmware Vi-Client

Vmware Virtualcenter

Vmware Vcenter Server

Vmware Vsphere Client

References · 3

• http://vmware.com/security/advisories/VMSA-2013-0001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1405 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1405 · Note