hostd-vmdb in VMware ESXi 4.0 through 5.0 and ESX 4.0 through 4.1 allows remote attackers to cause a denial of service (hostd-vmdb service outage) by modifying management traffic.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by a denial of service vulnerability in hostd-vmdb. A remote attacker can exploit this to cause a denial of service condition. Additionally, multiple vulnerabilities, including remote code execution vulnerabilities, exist in multiple Java Runtime Environment (JRE) components :

  - 2D
  - AWT
  - CORBA
  - Deployment
  - Hotspot
  - Install
  - JDBC
  - JMX
  - Libraries
  - Networking
  - Serialization
  - Serviceability
  - Sound

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - Multiple errors exist related to OpenSSL that could     allow information disclosure or denial of service     attacks. (CVE-2013-0166, CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities. An attacker can     exploit this to cause a denial of service. (CVE-2013-0338)

  - An unspecified error exists related to 'hostd-vmdb'. An     attacker can exploit this to cause a denial of service.
    (CVE-2013-5970)

  - An error exists in the handling of certain Virtual     Machine file descriptors. This may allow an unprivileged     user with the 'Add Existing Disk' privilege to obtain     read and write access to arbitrary files, possibly     leading to arbitrary code execution after a host reboot.
    (CVE-2013-5973)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. This issue may lead     to a denial of service if an attacker intercepts and     modifies the NFC traffic. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

a. VMware ESXi and ESX contain a vulnerability in hostd-vmdb. 

   To exploit this vulnerability, an attacker must intercept and    modify the management traffic. Exploitation of the issue may lead    to a Denial of Service of the hostd-vmdb service.

   To reduce the likelihood of exploitation, vSphere components    should be deployed on an isolated management network.
      VMware would like to thank Alex Chapman of Context Information    Security for reporting this issue to us. 

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-5970 to this issue.

b. VMware vSphere Web Client Server Session Fixation Vulnerability       The VMware vSphere Web Client Server contains a vulnerability in    the handling of session IDs. To exploit this vulnerability, an    attacker must know a valid session ID of an authenticated user.    Exploitation of the issue may lead to Elevation of Privilege.

   To reduce the likelihood of exploitation, vSphere components    should be deployed on an isolated management network.

   VMware would like to thank Alexey Tyurin of DSecRG for reporting    this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-5971 to this issue.

c. vCenter and Update Manager, Oracle JRE update 1.6.0_51.
      Oracle JRE is updated to version 1.6.0_51, which addresses    multiple security issues that existed in earlier releases of    Oracle JRE. 

   Oracle has documented the CVE identifiers that are addressed    in JRE 1.6.0_51 in the Oracle Java SE Critical Patch Update    Advisory of June 2013. The References section provides a    link to this advisory.

ID	Name	Product	Family	Type	Severity
89668	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2013-0012) (remote check)	Nessus	Misc.	Remote	critical
70879	ESXi 5.0 < Build 1311175 Multiple Vulnerabilities (remote check)	Nessus	Misc.	Remote	medium
70527	VMSA-2013-0012 : VMware vSphere updates address multiple vulnerabilities	Nessus	VMware ESX Local Security Checks	Local	high

Detections

Analytics

CVE-2013-5970

high

Tenable Plugins

critical

medium

high