Session fixation vulnerability in the vSphere Web Client Server in VMware vCenter Server 5.0 before Update 3 allows remote attackers to hijack web sessions and gain privileges via unspecified vectors.

The version of VMware vCenter installed on the remote host is 5.0 prior to update 3 or 5.1 prior to update 2.  It is, therefore, potentially affected by the following vulnerabilities :

  - A vulnerability exists in the handling of session IDs,     which could lead to an escalation of privileges.
    (CVE-2013-5971)

  - Multiple vulnerabilities exists in the bundled version     of the Java Runtime Environment.

a. VMware ESXi and ESX contain a vulnerability in hostd-vmdb. 

   To exploit this vulnerability, an attacker must intercept and    modify the management traffic. Exploitation of the issue may lead    to a Denial of Service of the hostd-vmdb service.

   To reduce the likelihood of exploitation, vSphere components    should be deployed on an isolated management network.
      VMware would like to thank Alex Chapman of Context Information    Security for reporting this issue to us. 

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-5970 to this issue.

b. VMware vSphere Web Client Server Session Fixation Vulnerability       The VMware vSphere Web Client Server contains a vulnerability in    the handling of session IDs. To exploit this vulnerability, an    attacker must know a valid session ID of an authenticated user.    Exploitation of the issue may lead to Elevation of Privilege.

   To reduce the likelihood of exploitation, vSphere components    should be deployed on an isolated management network.

   VMware would like to thank Alexey Tyurin of DSecRG for reporting    this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-5971 to this issue.

c. vCenter and Update Manager, Oracle JRE update 1.6.0_51.
      Oracle JRE is updated to version 1.6.0_51, which addresses    multiple security issues that existed in earlier releases of    Oracle JRE. 

   Oracle has documented the CVE identifiers that are addressed    in JRE 1.6.0_51 in the Oracle Java SE Critical Patch Update    Advisory of June 2013. The References section provides a    link to this advisory.

ID	Name	Product	Family	Type	Severity
70612	VMware Security Updates for vCenter Server (VMSA-2013-0012)	Nessus	Misc.	Remote	critical
70527	VMSA-2013-0012 : VMware vSphere updates address multiple vulnerabilities	Nessus	VMware ESX Local Security Checks	Local	high

Detections

Analytics

CVE-2013-5971

critical

Tenable Plugins

critical

high