SB2014120837 - Cryptographic issues in VMware, vCenter Server Appliance
Published: December 8, 2014 Updated: August 9, 2020
Security Bulletin ID
SB2014120837
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Cryptographic issues (CVE-ID: CVE-2014-8371)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
VMware vCenter Server Appliance (vCSA) 5.5 before Update 2, 5.1 before Update 3, and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host, which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.
Remediation
Install update from vendor's website.