VMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)

Critical Nessus Plugin ID 89740

Synopsis

The remote VMware ESX / ESXi host is missing a security-related patch.

Description

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

 - libpng
 - VMnc Codec
 - vmrun
 - VMware Remote Console (VMrc)
 - VMware Tools
 - vmware-authd

Solution

Apply the appropriate patch according to the vendor advisory that pertains to ESX version 3.5 / 4.0 or ESXi version 3.5 / 4.0.

See Also

https://www.vmware.com/security/advisories/VMSA-2010-0009

http://lists.vmware.com/pipermail/security-announce/2010/000099.html

Plugin Details

Severity: Critical

ID: 89740

File Name: vmware_VMSA-2010-0009_remote.nasl

Version: 1.5

Type: remote

Published: 2016/03/08

Updated: 2018/08/06

Dependencies: 57396

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/o:vmware:esx, cpe:/o:vmware:esxi

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/05/27

Vulnerability Publication Date: 2006/12/18

Exploitable With

CANVAS (CANVAS)

Core Impact

Reference Information

CVE: CVE-2006-6304, CVE-2007-4567, CVE-2009-0590, CVE-2009-1377, CVE-2009-1378, CVE-2009-1379, CVE-2009-1384, CVE-2009-1386, CVE-2009-1387, CVE-2009-2409, CVE-2009-2695, CVE-2009-2908, CVE-2009-2910, CVE-2009-3080, CVE-2009-3228, CVE-2009-3286, CVE-2009-3547, CVE-2009-3556, CVE-2009-3563, CVE-2009-3612, CVE-2009-3613, CVE-2009-3620, CVE-2009-3621, CVE-2009-3726, CVE-2009-3736, CVE-2009-3889, CVE-2009-3939, CVE-2009-4020, CVE-2009-4021, CVE-2009-4138, CVE-2009-4141, CVE-2009-4212, CVE-2009-4272, CVE-2009-4355, CVE-2009-4536, CVE-2009-4537, CVE-2009-4538, CVE-2010-0001, CVE-2010-0097, CVE-2010-0290, CVE-2010-0382, CVE-2010-0426, CVE-2010-0427

BID: 31692, 34256, 35001, 35112, 35138, 35174, 35417, 36304, 36472, 36576, 36639, 36706, 36723, 36824, 36827, 36901, 36936, 37019, 37068, 37069, 37118, 37128, 37255, 37339, 37519, 37521, 37523, 37749, 37806, 37865, 37876, 37886, 38432

VMSA: 2010-0009

CWE: 20, 119, 189, 200, 264, 287, 310, 362, 399