Executive Summary

Summary
Title Updated ESXi and ESX 3.5 packages address critical security issue in openwsman
Informations
Name VMSA-2008-0015 First vendor Publication 2008-09-18
Vendor VMware Last vendor Modification 2008-09-18
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

a. Updated Openwsman

Openwsman is a system management platform that implements the Web Services Management protocol (WS-Management). It is installed and running by default. It is used in the VMware Management Service Console and in ESXi.

The openwsman 2.0.0 management service on ESX 3.5 and ESXi 3.5 is vulnerable to the following issue found by the SuSE Security-Team:

- Two remote buffer overflows while decoding the HTTP basic authentication header

This vulnerability could potentially be exploited by users without valid login credentials.

Openwsman before 2.0.0 is not vulnerable to this issue. The ESXi 3.5 patch ESXe350-200808201-O-UG updated openwsman to version 2.0.0. The ESX 3.5 patch ESX350-200808205-UG updated openwsman to version 2.0.0. These patches are installed as part of the ESX and ESXi Upgrade 2 release. The ESX patch can be installed individually.

Version Information and Workaround The following VMware KB articles provide information on how to obtain the version of openwsman in your environment and what a possible workaround for the issue might be. ESXi 3.5 Refer to the VMware KB article at http://kb.vmware.com/kb/1005818. ESX 3.5 Refer to the VMware KB article at http://kb.vmware.com/kb/1006878.

Note: This vulnerability can be exploited remotely only if the attacker has access to the service console network. Security best practices provided by VMware recommend that the service console be isolated from the VM network. Please see http://www.vmware.com/resources/techresources/726 for more information on VMware security best practices.

The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2008-2234 this issue.

Original Source

Url : http://www.vmware.com/security/advisories/VMSA-2008-0015.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
50 % CWE-94 Failure to Control Generation of Code ('Code Injection')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2

SAINT Exploits

Description Link
Openwsman HTTP Basic Authentication buffer overflow More info here

OpenVAS Exploits

Date Description
2009-01-23 Name : SuSE Update for openwsman SUSE-SA:2008:041
File : nvt/gb_suse_2008_041.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
47784 Openwsman Client Unspecified SSL Session Replay

Openwsman contains a flaw related to the SSL session integrity of the service. The issue is triggered when a remote attacker exploits the 'callback-verify' function in the OpenSSL library that does not verify the host providing a certificate while verifying the fingerprint of the received certificate. This may allow an attacker to replay session information.
47534 Openwsman HTTP Basic Authentication Header Decoding Remote Overflow

Information Assurance Vulnerability Management (IAVM)

Date Description
2008-09-25 IAVM : 2008-B-0064 - Multiple Vulnerabilities in Openwsman (VMWare)
Severity : Category I - VMSKEY : V0017414

Snort® IPS/IDS

Date Description
2014-01-10 Openwsman HTTP basic authentication buffer overflow attempt
RuleID : 14992 - Revision : 8 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date Description
2011-02-17 Name : The remote VMware ESXi host is missing a security-related patch.
File : vmware_VMSA-2008-0015.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_libwsman-devel-080814.nasl - Type : ACT_GATHER_INFO
2008-08-22 Name : The remote openSUSE host is missing a security update.
File : suse_libwsman-devel-5531.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 12:07:09
  • Multiple Updates
2013-11-11 12:41:38
  • Multiple Updates