Detections
Analytics
VMware ESX/ESXi CIM Services Multiple Vulnerabilities
high Nessus Plugin ID 70448
Language:
Synopsis
The remote VMware ESXi / ESX host is missing a security-related patch.Description
The remote VMware ESXi / ESX host is potentially affected by the following vulnerabilities :- A buffer overflow flaw exists that allows remote, authenticated attackers to execute arbitrary code.
(CVE-2013-3657)
- A directory traversal flaw exists that allows remote attackers to delete arbitrary files. (CVE-2013-3658)
Note that the vendor has not publicly acknowledged these flaws.
Solution
The vendor reportedly has silently patched these issues in the following releases :- ESX/ESXi 4.0: Patch 201203401
- ESX/ESXi 4.1: Patch 201201401
- ESXi 5.0: Patch 201203101
See Also
Plugin Details
Severity: High
ID: 70448
File Name: vmware_cim_services_rce.nasl
Version: 1.2
Type: local
Family: VMware ESX Local Security Checks
Published: 10/15/2013
Updated: 8/6/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.4
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C
Vulnerability Information
CPE: cpe:/o:vmware:esx:4.0, cpe:/o:vmware:esx:4.1, cpe:/o:vmware:esx:5.0
Required KB Items: Host/local_checks_enabled, Host/VMware/release, Host/VMware/version, Host/VMware/esxupdate
Exploit Ease: No known exploits are available
Patch Publication Date: 3/29/2012
Vulnerability Publication Date: 8/24/2013
Reference Information
CVE: CVE-2013-3657, CVE-2013-3658