Executive Summary
| Summary | |
|---|---|
| Title | VMware ESXi and ESX unauthorized file access through vCenter Server and ESX |
| Informations | |||
|---|---|---|---|
| Name | VMSA-2013-0016 | First vendor Publication | 2013-12-22 |
| Vendor | VMware | Last vendor Modification | 2013-12-22 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.4 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| a. VMware ESXi and ESX unauthorized file access through vCenter Server and ESX VMware ESXi and ESX contain a vulnerability in the handling of certain Virtual Machine file descriptors. This issue may allow an unprivileged vCenter Server user with the privilege â |
Original Source
| Url : http://www.vmware.com/security/advisories/VMSA-2013-0016.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24054 | |||
| Oval ID: | oval:org.mitre.oval:def:24054 | ||
| Title: | VMware ESXi and ESX unauthorized file access through vCenter Server and ESX | ||
| Description: | VMware ESXi 4.0 through 5.5 and ESX 4.0 and 4.1 allow local users to read or modify arbitrary files by leveraging the Virtual Machine Power User or Resource Pool Administrator role for a vCenter Server Add Existing Disk action with a (1) -flat, (2) -rdm, or (3) -rdmp filename. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2013-5973 | Version: | 4 |
| Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-03-04 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_esx_VMSA-2013-0016_remote.nasl - Type : ACT_GATHER_INFO |
| 2013-12-31 | Name : The remote VMware ESXi 5.1 host is affected by a privilege escalation vulnera... File : vmware_esxi_5_1_build_1312874_remote.nasl - Type : ACT_GATHER_INFO |
| 2013-12-31 | Name : The remote VMware ESXi 5.5 host is affected by a privilege escalation vulnera... File : vmware_esxi_5_5_build_1474526_remote.nasl - Type : ACT_GATHER_INFO |
| 2013-12-23 | Name : The remote VMware ESXi / ESX host is missing a security-related patch. File : vmware_VMSA-2013-0016.nasl - Type : ACT_GATHER_INFO |
| 2013-11-13 | Name : The remote VMware ESXi 5.0 host is affected by multiple security vulnerabilit... File : vmware_esxi_5_0_build_1311177_remote.nasl - Type : ACT_GATHER_INFO |
| 2013-11-13 | Name : The remote VMware ESXi 5.1 host is affected by multiple security vulnerabilit... File : vmware_esxi_5_1_build_1063671_remote.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2016-03-05 13:26:43 |
|
| 2015-12-17 13:26:56 |
|
| 2014-02-17 12:07:28 |
|
| 2013-12-24 17:22:00 |
|
| 2013-12-23 21:25:17 |
|
| 2013-12-23 13:18:29 |
|
