Multiple vulnerabilities in VMware, vCenter Server

Published: 2015-09-19 | Updated: 2020-08-09

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2016-7459 CVE-2015-6932
CWE-ID	CWE-611 CWE-310
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	vCenter Server Server applications / Virtualization software
Vendor	VMware, Inc

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) XML External Entity injection

EUVDB-ID: #VU39958

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7459

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) Distributed Switch setup, or (3) Content Library XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Mitigation

Install update from vendor's website.

Vulnerable software versions

vCenter Server: 5.0 - 6.0

CPE2.3

External links

http://www.securityfocus.com/bid/94486
http://www.securitytracker.com/id/1037329
http://www.vmware.com/security/advisories/VMSA-2016-0022.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cryptographic issues

EUVDB-ID: #VU40647

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-6932

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.