Multiple vulnerabilities in VMware vCenter Server and Tools



Risk Low
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2015-5191
CVE-2017-4922
CVE-2017-4923
CVE-2017-4921
CWE-ID CWE-362
CWE-200
CWE-426
Exploitation vector Network
Public exploit N/A
Vulnerable software
 VMware Tools
Client/Desktop applications / Other client software

vCenter Server
Server applications / Virtualization software

Vendor VMware, Inc

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Race condition

EUVDB-ID: #VU7639

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-5191

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges.

The vulnerability exists due to a race condition in the libDeployPkg component. A local attacker can use the hard-coded paths under /tm, trigger race condition and gain root privileges on the system.

Mitigation

Update to version 10.0.9.

Vulnerable software versions

VMware Tools: 9.0.0 - 10.0.8

CPE2.3 External links

https://www.vmware.com/security/advisories/VMSA-2017-0013.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU7640

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-4922

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to improper storing of sensitive information by the service startup script. A remote attacker can trigger the service startup script restart and access important data that may be used to conduct further attack.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update to version 6.5 U1.

Vulnerable software versions

vCenter Server: 6.5.0

CPE2.3 External links

https://www.vmware.com/security/advisories/VMSA-2017-0013.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU7641

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-4923

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to improper security restrictions that are set on the vCenter Server Appliance file-based backup feature. A remote attacker can use the file-based backup feature to access important data, such as plaintext credentials, that may be used to conduct further attack.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Update to version 6.5 U1.

Vulnerable software versions

vCenter Server: 6.5.0

CPE2.3 External links

https://www.vmware.com/security/advisories/VMSA-2017-0013.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Insecure DLL library loading

EUVDB-ID: #VU7643

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-4921

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges.

The vulnerability exists due to insecure library loading flaw in the LD_LIBRARY_PATH variable. A remote attacker can trick the victim into execution of wrapper scripts from a world writable directory and gain elevated privileges. 

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update to version 6.5 U1.

Vulnerable software versions

vCenter Server: 6.5.0

CPE2.3 External links

https://www.vmware.com/security/advisories/VMSA-2017-0013.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###