PT-2015-2314 · Vmware · Vmware Vcenter Server+1

Doug Mcleod · Published 2015-09-22 · Updated 2018-08-12 · CVE-2015-2342

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.0 through 5.0 u3e VMware vCenter Server versions 5.1 through 5.1 u3b VMware vCenter Server versions 5.5 through 5.5 u3 VMware vCenter Server versions 6.0 through 6.0 u1

Description The issue is related to the JMX RMI service in VMware vCenter Server, which does not properly restrict the registration of MBeans. This allows remote attackers to execute arbitrary code via the RMI protocol. The vulnerability is also associated with configuration errors of the JMX server, including the lack of authentication and encryption procedures when clients connect to the JMX server. Exploitation of the vulnerability can enable a remote attacker to execute arbitrary Java code.

Recommendations For versions 5.0 through 5.0 u3e, update to version 5.0 u3e or later. For versions 5.1 through 5.1 u3b, update to version 5.1 u3b or later. For versions 5.5 through 5.5 u3, update to version 5.5 u3 or later. For versions 6.0 through 6.0 u1, update to version 6.0 u1 or later. As a temporary workaround, consider restricting access to the JMX RMI service to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-16

Related Identifiers

BDU:2015-11676

CVE-2015-2342

ZDI-15-455

Affected Products

Vmware Vcenter

Vmware Vcenter Server

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_jmx_server.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/java_jmx_server.rb · Exploit
• 🔥 https://exploit-db.com/exploits/36101 · Exploit
• https://bdu.fstec.ru/vul/2015-11676 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2342 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-455 · Security Note
• http://vmware.com/security/advisories/VMSA-2015-0007.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2342 · Note
• https://7elements.co.uk/resources/technical-advisories/cve-2015-2342-vmware-vcenter-remote-code-execution · Note
• http://securitytracker.com/id/1033720 · Note
• http://seclists.org/fulldisclosure/2015/Oct/1 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-455 · Note
• http://securityfocus.com/bid/76930 · Note