KLA11142 DoS and OSI vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware vCenter Server and vSphere Web Client. Malicious users can exploit these vulnerabilities to cause denial of service or disclose sensetive information.

Below is a complete list of vulnerabilities:

1. An unspecified vulnerability in VMware vCenter Server can be exploited remotely via specially crafted LDAP network packet to cause denial of service;
2. SSRF and CRLF injection issues in vSphere Web Client i.e. not the new HTML5-based vSphere Client can be exploited remotely to disclose sensetive information.

Original advisories

VMSA-2017-0017

Related products

VMware-vSphere-Client

VMware-vCenter-Server

CVE list

CVE-2017-4928 warning

CVE-2017-4927 warning

Solution

Update to latest versions

Download VMware vCenter Server

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• VMware vCenter Server 6.5 without 6.5 U1 patchVMware vCenter Server 6.0 without 6.0 U3c patch
  vCenter Server 5.5 without 5.5 U3f patch