Executive Summary
Summary | |
---|---|
Title | Updated ESXi and ESX 3.5 packages address critical security issue in openwsman |
Informations | |||
---|---|---|---|
Name | VMSA-2008-0015 | First vendor Publication | 2008-09-18 |
Vendor | VMware | Last vendor Modification | 2008-09-18 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
a. Updated Openwsman Openwsman is a system management platform that implements the Web Services Management protocol (WS-Management). It is installed and running by default. It is used in the VMware Management Service Console and in ESXi. The openwsman 2.0.0 management service on ESX 3.5 and ESXi 3.5 is vulnerable to the following issue found by the SuSE Security-Team: - Two remote buffer overflows while decoding the HTTP basic authentication header This vulnerability could potentially be exploited by users without valid login credentials. Openwsman before 2.0.0 is not vulnerable to this issue. The ESXi 3.5 patch ESXe350-200808201-O-UG updated openwsman to version 2.0.0. The ESX 3.5 patch ESX350-200808205-UG updated openwsman to version 2.0.0. These patches are installed as part of the ESX and ESXi Upgrade 2 release. The ESX patch can be installed individually. Version Information and Workaround The following VMware KB articles provide information on how to obtain the version of openwsman in your environment and what a possible workaround for the issue might be. ESXi 3.5 Refer to the VMware KB article at http://kb.vmware.com/kb/1005818. ESX 3.5 Refer to the VMware KB article at http://kb.vmware.com/kb/1006878. Note: This vulnerability can be exploited remotely only if the attacker has access to the service console network. Security best practices provided by VMware recommend that the service console be isolated from the VM network. Please see http://www.vmware.com/resources/techresources/726 for more information on VMware security best practices. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2008-2234 this issue. |
Original Source
Url : http://www.vmware.com/security/advisories/VMSA-2008-0015.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
50 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 2 |
SAINT Exploits
Description | Link |
---|---|
Openwsman HTTP Basic Authentication buffer overflow | More info here |
OpenVAS Exploits
Date | Description |
---|---|
2009-01-23 | Name : SuSE Update for openwsman SUSE-SA:2008:041 File : nvt/gb_suse_2008_041.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
47784 | Openwsman Client Unspecified SSL Session Replay Openwsman contains a flaw related to the SSL session integrity of the service. The issue is triggered when a remote attacker exploits the 'callback-verify' function in the OpenSSL library that does not verify the host providing a certificate while verifying the fingerprint of the received certificate. This may allow an attacker to replay session information. |
47534 | Openwsman HTTP Basic Authentication Header Decoding Remote Overflow |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2008-09-25 | IAVM : 2008-B-0064 - Multiple Vulnerabilities in Openwsman (VMWare) Severity : Category I - VMSKEY : V0017414 |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Openwsman HTTP basic authentication buffer overflow attempt RuleID : 14992 - Revision : 8 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2011-02-17 | Name : The remote VMware ESXi host is missing a security-related patch. File : vmware_VMSA-2008-0015.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libwsman-devel-080814.nasl - Type : ACT_GATHER_INFO |
2008-08-22 | Name : The remote openSUSE host is missing a security update. File : suse_libwsman-devel-5531.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:07:09 |
|
2013-11-11 12:41:38 |
|