VMware View critical directory traversal vulnerability

(DDI) Vulnerability Research Team (VRT) for reported a critical vulnerability in VMware View Server , that is a directory traversal vulnerability that allows an unauthenticated remote attacker to retrieve arbitrary files from affected View Servers. Exploitation of this issue may expose sensitive information stored on the server.

VMware has issued a patch for its VMware View product. It is listed as ‘VMSA-2012-0017’ in security advisory.

This vulnerability affects both the View Connection Server and the View Security Server; VMware recommends that customers immediately update both servers to a fixed version of View. The Common Vulnerabilities and Exposures project has assigned the name CVE-2012-5978 to this issue.

VMware’s update to VMware View is available for free to license holders of the product and can be downloaded here.

Disabling the Security Server will prevent exploitation of this vulnerability over untrusted remote networks or It may be possible to prevent exploitation of this issue by blocking directory traversal attacks with an intrusion protection system or application layer firewall.