6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.055 Low
EPSS
Percentile
93.1%
a. ESX/ESXi Socket ExhaustionBy sending malicious network traffic to an ESXi or ESX host an attacker could exhaust the available sockets which would prevent further connections to the host. In the event a host becomes inaccessible its virtual machines will continue to run and have network connectivity but a reboot of the ESXi or ESX host may be required in order to be able to connect to the host again. ESXi and ESX hosts may intermittently lose connectivity caused by applications that do not correctly close sockets. If this occurs an error message similar to the following may be written to the vpxa log: socket() returns -1 (Cannot allocate memory) An error message similar to the following may be written to the vmkernel logs: socreate(type=2, proto=17) failed with error 55 VMware would like to thank Jimmy Scott at inet-solutions.be for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2011-1785 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
CPE | Name | Operator | Version |
---|---|---|---|
esxi | lt | ESXi410-201104401-SG | |
esxi | lt | ESXi400-201104401-SG | |
esx | lt | ESX410-201104401-SG | |
esx | lt | ESX400-201104401-SG | |
esx | lt | see VMSA-2011-0003 section j |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1323
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1324
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2240
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4020
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4021
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1785
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1786
web.mit.edu/Kerberos/advisories/MITKRB5-SA-2010-007.txt
www.vmware.com/security/advisories/VMSA-2011-0003.html
6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.055 Low
EPSS
Percentile
93.1%