PT-2015-3763 · Vmware+1 · Vmware Vsphere Data Protection+3

Published 2015-02-01 · Updated 2017-08-29 · CVE-2014-4632

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware vSphere Data Protection (VDP) versions 5.1, 5.5 through 5.5.8, 5.8 through 5.8.0 EMC Avamar Data Store (ADS) versions 6.x EMC Avamar Virtual Edition (AVE) versions 6.x, 7.0.x

Description The issue allows man-in-the-middle attackers to spoof servers and bypass intended backup and restore access restrictions via a crafted X.509 certificate, due to improper verification of these certificates from vCenter Server SSL servers.

Recommendations For VMware vSphere Data Protection (VDP) versions 5.1, update to version 5.5.9 or later. For VMware vSphere Data Protection (VDP) versions 5.5 through 5.5.8, update to version 5.5.9 or later. For VMware vSphere Data Protection (VDP) versions 5.8 through 5.8.0, update to version 5.8.1 or later. For EMC Avamar Data Store (ADS) versions 6.x, update to a version that properly verifies X.509 certificates. For EMC Avamar Virtual Edition (AVE) versions 6.x, 7.0.x, update to a version that properly verifies X.509 certificates.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-4632

Affected Products

Emc Avamar Data Store

Avamar Virtual Edition

Vmware Vsphere Data Protection

Vcenter Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-4632 · Security Note
• http://vmware.com/security/advisories/VMSA-2015-0002.html · Vendor Advisory
• http://securitytracker.com/id/1031664 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100866 · Note
• http://archives.neohapsis.com/archives/bugtraq/2015-01/0154.html · Note