SB2012122104 - Multiple vulnerabilities in VMware, vCenter Server Appliance

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2013-3079)

The vulnerability allows a remote #AU# to execute arbitrary code.

VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to execute arbitrary programs with root privileges by leveraging Virtual Appliance Management Interface (VAMI) access.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-3080)

The vulnerability allows a remote #AU# to execute arbitrary code.

VMware vCenter Server Appliance (vCSA) 5.1 before Update 1 allows remote authenticated users to create or overwrite arbitrary files, and consequently execute arbitrary code or cause a denial of service, by leveraging Virtual Appliance Management Interface (VAMI) web-interface access.

3) Path traversal (CVE-ID: CVE-2012-6324)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 and 5.1 before Patch 1. A remote authenticated attacker can send a specially crafted HTTP request and remote authenticated users to read arbitrary files via unspecified vectors.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.vmware.com/security/advisories/VMSA-2013-0006.html
• http://www.vmware.com/security/advisories/VMSA-2012-0018.html