PT-2014-8495 · Vmware · Vmware Vcenter Server Appliance+2

Published 2014-12-04 · Updated 2018-10-09 · CVE-2014-8371

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware vCenter Server Appliance (vCSA) versions 5.0 through 5.0 before Update 3c VMware vCenter Server Appliance (vCSA) versions 5.1 through 5.1 before Update 3 VMware vCenter Server Appliance (vCSA) versions 5.5 through 5.5 before Update 2

Description The issue is related to the improper validation of certificates when connecting to a CIM Server on an ESXi host. This allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate, potentially leading to a Man-in-the-middle attack against the CIM service.

Recommendations For versions 5.0 through 5.0 before Update 3c, update to Update 3c or later. For versions 5.1 through 5.1 before Update 3, update to Update 3 or later. For versions 5.5 through 5.5 before Update 2, update to Update 2 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-8371

Affected Products

Esxi

Vmware Vcenter

Vmware Vcenter Server Appliance

References · 6

• http://vmware.com/security/advisories/VMSA-2014-0012.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8371 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8371 · Note
• https://vmware.com/security/advisories/VMSA-2014-0012.html · Note
• http://securityfocus.com/archive/1/534161/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2014/Dec/23 · Note