ESXi 5.1 < Build 1743201 Multiple Vulnerabilities (remote check)

The remote VMware ESXi host is version 5.1 prior to build 1743201. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the monlist feature in NTP. A remote attacker can exploit this flaw, using a specially crafted packet to load the query function in monlist, to conduct a...

VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues

a. VMware ESXi, Workstation, Player, and Fusion host privilege escalation vulnerability VMware ESXi, Workstation, Player and Fusion contain an arbitrary file write issue. Exploitation this issue may allow for privilege escalation on the host. The vulnerability does not allow for privilege...

ESXi 5.1 < Build 2323231 glibc Library Multiple Vulnerabilities (remote check)

The remote VMware ESXi host is version 5.1 prior to build 2323231. It is, therefore, affected by the following vulnerabilities in the glibc library : - A buffer overflow flaw exists in the 'extendbuffers' function of the 'posix/regexec.c' file due to improper validation of user input. Using a...

ESXi 5.1 < Build 2323236 Third-Party Libraries Multiple Vulnerabilities (remote check) (BEAST)

The remote VMware ESXi host is version 5.1 prior to build 2323236. It is, therefore, affected by the following vulnerabilities in bundled third-party libraries : - Multiple vulnerabilities exist in the bundled Python library. CVE-2011-3389, CVE-2012-0845, CVE-2012-0876, CVE-2012-1150,...

VMware Security Updates for vCenter Server (VMSA-2014-0012)

The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2. It is, therefore, affected by multiple vulnerabilities in third party libraries : - Due to improper certificate validation when connecting to a CIM server on ...

VMware fixes XSS vulnerabilities and a certificate validation issue-bug warning-the black bar safety net

VMware this week released a series of patches fixes multiple vulnerabilities, including its server virtualization platform. A vulnerability exists in VMware vCenter Server Appliance vCSAis a VMware vCenter Server of a component. The mainXSSVulnerabilityCVE-2 0 1 4-3 7 9 7by Trustware Spiderlabs...

VMware Releases Patches for XSS, Cert. Validation Issue

VMware released a handful of patches late last week to fix several vulnerabilities, including a nasty cross-site scripting issue in one of its server virtualization platforms. The vulnerabilities lie in VMware’s vCenter Server Appliance vCSA – a module for VMware’s vCenter Server. The main bug, a...

CVE-2014-8371

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

CVE-2014-8371

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

Code injection

VMware vCenter Server Appliance vCSA 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate...

CVE-2014-8371

CVE-2014-8371 affects VMware vCenter Server and vCSA when connecting to an ESXi CIM server; root cause is improper certificate validation that enables MITM spoofing of CIM services. Affected versions: vCSA 5.5 before Update 2, vCenter Server 5.1 before Update 3, and 5.0 before Update 3c. Remediat...

VMSA-2014-0012 : VMware vSphere product updates address security vulnerabilities

a. VMware vCSA cross-site scripting vulnerability VMware vCenter Server Appliance vCSA contains a vulnerability that may allow for Cross Site Scripting. Exploitation of this vulnerability in vCenter Server requires tricking a user to click on a malicious link or to open a malicious web page. VMwa...

VMware Releases Security Updates for vCenter Server, vCenter Server Appliance, and ESXi

VMware has released a security advisory to address multiple vulnerabilities in vCenter Server, vCenter Server Appliance, and ESXi. Exploitation of these vulnerabilities may allow a remote attacker to perform man-in-the-middle or cross-site scripting attacks. US-CERT encourages users and...

VMware ESXi product updates address security vulnerabilities (VMSA-2014-0012)

VMware vSphere product updates address a Cross Site Scripting issue, a certificate validation issue and security vulnerabilities in third-party libraries. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

VMware ESXi updates address security vulnerabilities (VMSA-2014-0012) - Remote Version Check

VMware ESXi updates address a Cross Site Scripting issue, a certificate validation issue and security vulnerabilities in third-party libraries. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective righ...

VMware CBT Data Corruption

This KB explains and details how to detect/prevent the VMware bug that exists in VMware ESXi 4.x and 5.x...

Veeam doesn't clean up temporary datastore in vSphere after restore from NetApp storage snapshot

Challenge After completing one of the restore options available for NetApp storage snapshot, you may notice that the temporary datastore under the name "snap--" is still mounted on the ESXi hosts with inactive status. See the screenshot below for an example: After a manual rescan of the storage...

ESXi 5.5 < Build 1980513 glibc Library Multiple Vulnerabilities (remote check)

The remote VMware ESXi host is version 5.5 prior to build 1980513. It is, therefore, affected by the following vulnerabilities in the glibc library : - A buffer overflow flaw exists in the 'extendbuffers' function of the 'posix/regexec.c' file, due to not properly validating user input. Using a...

NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VMware Security Advisory Advisory ID: VMSA-2014-0010 Synopsis: VMware product updates address critical Bash security vulnerabilities Issue date: 2014-09-30 Updated on: 2014-09-30 Initial Advisory CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-718...

VMSA-2014-0010 : VMware product updates address critical Bash security vulnerabilities (Shellshock)

a. Bash update for multiple products. Bash libraries have been updated in multiple products to resolve multiple critical security issues, also referred to as Shellshock. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the identifiers CVE-2014-6271, CVE-2014-7169,...