Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : update-manager vulnerabilities (USN-1284-1)

David Black discovered that Update Manager incorrectly extracted the downloaded upgrade tarball before verifying its GPG signature. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to replace arbitrary files. CVE-2011-3152 David Black...

Ubuntu升级管理器GPG签名校验安全绕过漏洞

CVE ID：CVE-2011-3152 Ubuntu是一款基于linux内核的发行版本。 David Black发现更新管理器Update Manager在校验GPG签名之前不正确提取下载的升级tarball，如果远程攻击者可执行中间人攻击，此缺陷可导致用于替换任意文件 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux...

USN-1284-1: Update Manager vulnerabilities

David Black discovered that Update Manager incorrectly extracted the downloaded upgrade tarball before verifying its GPG signature. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to replace arbitrary files. CVE-2011-3152 David Black...

CVE-2011-3154

DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file...

VMware vCenter Update Manager Detection

VMware vCenter Update Manager also known as vSphere Update Manager was detected on the remote host. This application is used to manage patches on vSphere hosts. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid56957; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/22";...

CVE-2011-3152

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade...

VMware vCenter Update Manager Directory Traversal (VMSA-2011-0014)

The version of Jetty web server included with VMware vCenter Update Manager on the remote host has a directory traversal vulnerability. This is a variant of the issue previously addressed by VMware advisory VMSA-2010-0012. The web server runs as SYSTEM by default. A remote, unauthenticated attack...

VMware Update Manager 4 Directory Traversal

This modules exploits a directory traversal vulnerability in VMware Update Manager on port 9084. Versions affected by this vulnerability: vCenter Update Manager 4.1 prior to Update 2, vCenter Update Manager 4 Update 4. Module Options msf use auxiliary/scanner/vmware/vmware/updatemanagertraversal...

VMware Update Manager Directory Traversal

DSECRG-11-042 VMware Update Manager - Directory Traversal Application: VMware Update Manager Versions Affected: vCenter Update Manager 4.1 prior to Update 2, vCenter Update Manager 4.0 prior to Update 4 Vendor URL: http://vmware.com Bugs: Directory Traversal File Read CVE: CVE-2011-4404 CVSS2: 7....

VMware - Update Manager Directory Traversal

VMware - Update Manager Directory Traversal Exploit Title:VMware Update Manager Directory Traversal Date:18/11/2011 Author: Alexey Sintsov Software Link: http://www.vmware.com/ Version:2.0.2 Tested on: Windows 2003 / vCenter Update Manager 4.1 U1 CVE : CVE-2011-4404 DSECRG-11-042 VMware Update...

Jetty Web Server不明细节目录遍历漏洞

BUGTRAQ ID: 50723 CVE ID: CVE-2011-4404 Jetty是一款流行的Java Web服务器。 Jetty Web Server在实现上存在不明细节目录遍历漏洞，可使攻击者查看Web服务器中的任意文件，造成信息泄露 VMWare vCenter Update Manager 4.1 VMWare vCenter Update Manager 4.0 Jetty Jetty Web Server 厂商补丁： Jetty ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

VMware - Update Manager Directory Traversal

Exploit Title:VMware Update Manager Directory Traversal Date:18/11/2011 Author: Alexey Sintsov Software Link: http://www.vmware.com/ Version:2.0.2 Tested on: Windows 2003 / vCenter Update Manager 4.1 U1 CVE : CVE-2011-4404 DSECRG-11-042 VMware Update Manager - Directory Traversal Application:...

VMSA-2011-0014 VMware vCenter Update Manager fix for Jetty Web server addresses directory traversal vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ----------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2011-0014 Synopsis: VMware vCenter Update Manager fix for Jetty Web server addresses directory traversal vulnerability Issue date:...

VMware Update Manager Directory Traversal

Exploit for windows platform in category remote exploits Exploit Title:VMware Update Manager Directory Traversal Date:18/11/2011 Author: Alexey Sintsov Software Link: http://www.vmware.com/ Version:2.0.2 Tested on: Windows 2003 / vCenter Update Manager 4.1 U1 CVE : CVE-2011-4404 DSECRG-11-042...

CVE-2011-4404

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to...

CVE-2011-4404

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to...

Directory traversal

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to...

CVE-2011-4404

CVE-2011-4404 concerns a directory-traversal vulnerability in Jetty’s HTTP server used by VMware vCenter Update Manager (VMware vSphere Update Manager) where the default Jetty config permits remote attackers to read arbitrary files via directory traversal. Affected are vUM 4.0.x (before Update 4)...

PT-2011-4946

Name of the Vulnerable Software and Affected Versions vCenter Update Manager versions 4.0 before Update 4 vCenter Update Manager versions 4.1 before Update 2 Description The default configuration of the HTTP server in Jetty in vSphere Update Manager allows remote attackers to conduct directory...

CVE-2011-4404: Undefined Security Weakness

The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to...