a. VMware vCenter Update Manager Jetty Web server vulnerabilities
VMware vCenter Update Manager is an automated patch management solution for VMware ESX hosts and Microsoft virtual machines. Update Manager embeds the Jetty Web server which is a third party component.
The default version of the Jetty Web server in Update Manager is version 6.1.6 for which the following relevant vulnerabilities are reported.
A directory traversal vulnerability in Jetty allows for obtaining files from the system where Update Manager is installed by a remote, unauthenticated attacker. The attacker would need to be on the same network as the system where Update Manager is installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2009-1523 and CVE-2009-1524 to these issues.
VMware would like to thank Claudio Criscione of Secure Network for reporting these issues to us.
Column 4 of the following table lists the action required to remediate the vulnerabilities in each release, if a solution is available.