PT-2013-3301 · Vmware · Vmware Esxi

Published 2013-09-04 · Updated 2013-09-30 · CVE-2013-1661

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 4.0 through 5.1 VMware ESX versions 4.0 and 4.1

Description The issue is related to the improper implementation of the Network File Copy (NFC) protocol. This allows man-in-the-middle attackers to cause a denial of service by modifying the client-server data stream, resulting in an unhandled exception and application crash.

Recommendations For VMware ESXi versions 4.0 through 5.1, update to a version that properly implements the NFC protocol to prevent denial of service attacks. For VMware ESX versions 4.0 and 4.1, consider disabling the NFC protocol until a patch or update is available that corrects the implementation issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1661

Affected Products

Vmware Esxi

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-1661 · Security Note
• http://vmware.com/security/advisories/VMSA-2013-0011.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1661 · Note