Detections
Analytics
VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2014-0002)
medium Nessus Plugin ID 87674
Language:
Synopsis
The remote VMware ESX / ESXi host is missing a security-related patch.Description
The remote VMware ESX / ESXi host is affected by multiple vulnerabilities :- Multiple integer overflow conditions exist in the glibc package in file malloc/malloc.c. An unauthenticated, remote attacker can exploit these to cause heap memory corruption by passing large values to the pvalloc(), valloc(), posix_memalign(), memalign(), or aligned_alloc() functions, resulting in a denial of service. (CVE-2013-4332)
- A distributed denial of service (DDoS) vulnerability exists in the NTP daemon due to improper handling of the 'monlist' command. A remote attacker can exploit this, via a forged request to an affected NTP server, to cause an amplified response to the intended target of the DDoS attack. (CVE-2013-5211)
Solution
Apply the appropriate patch according to the vendor advisory that pertains to ESX version 4.0 / 4.1 and ESXi version 4.0 / 4.1 / 5.0 / 5.1 / 5.5.See Also
https://www.vmware.com/security/advisories/VMSA-2014-0002
http://lists.vmware.com/pipermail/security-announce/2014/000281.html
Plugin Details
Severity: Medium
ID: 87674
File Name: vmware_VMSA-2014-0002_remote.nasl
Version: 1.5
Type: remote
Family: Misc.
Published: 12/30/2015
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.1
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: cpe:/o:vmware:esx:4.0, cpe:/o:vmware:esx:4.1, cpe:/o:vmware:esxi:4.0, cpe:/o:vmware:esxi:4.1, cpe:/o:vmware:esxi:5.0, cpe:/o:vmware:esxi:5.1, cpe:/o:vmware:esxi:5.5
Required KB Items: Host/VMware/release, Host/VMware/version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/4/2014
Vulnerability Publication Date: 4/29/2010
Reference Information
CVE: CVE-2013-4332, CVE-2013-5211