VMSA-2011-0008 VMware vCenter Server and vSphere Client security vulnerabilities

               VMware Security Advisory

A directory traversal vulnerability allows an attacker to remotely
retrieve files from vCenter Server without authentication. In order
to exploit this vulnerability, the attacker will need to have access
to the network on which the vCenter Server host resides.

In case vCenter Server is installed on Windows 2008 or
Windows 2008 R2, the security vulnerability is not present.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41; has
assigned the name CVE-2011-0426 to this issue.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        4.1       Windows  Update 1 *
vCenter        4.0       Windows  Update 3 *
VirtualCenter  2.5       Windows  Update 6a

hosted **      any       any      not affected

ESXi           any       ESXi     not affected

ESX            any       ESX      not affected

The SOAP session ID can be retrieved by any user that is logged in
to vCenter Server. This might allow a local unprivileged user on
vCenter Server to elevate his or her privileges.

VMware would like to thank Claudio Criscione for reporting this
issue to us.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the name CVE-2011-1788 to this issue.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        4.1       Windows  Update 1
vCenter        4.0       Windows  Update 3
VirtualCenter  2.5       Windows  not affected

hosted *       any       any      not affected

ESXi           any       ESXi     not affected

ESX            any       ESX      not affected

The digitally signed vSphere Client installer is packaged in a
self-extracting installer package which is not digitally signed. As
a result, when you run the install package file to extract and start
installing, the vSphere Client installer may display a Windows
warning message stating that the publisher of the install package
cannot be verified.

The vSphere Client Installer package of the following product
versions is now digitally signed:

  vCenter Server 4.1 Update 1
  vCenter Server 4.0 Update 3

  ESXi 4.1 Update 1
  ESXi 4.0 with patch ESXi400-201103402-SG

  ESX 4.1 Update 1
  ESX 4.0 with patch ESX400-201103401-SG

An install or update of the vSphere Client from these releases will
not present a security warning from Windows.
Note: typically the vSphere Client will request an update if the
existing client is pointed at a newer version of vCenter or ESX.

VMware Knowledge Base article 1021404 explains how the unsigned
install package can be obtained in an alternative, secure way for an
environment with VirtualCenter 2.5, ESXi/ESX 3.5 or ESX 3.0.3.

VMware would like to thank Claudio Criscione for reporting this
issue to us.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the name CVE-2011-1789 to this issue.

VMSA-2011-0008 VMware vCenter Server and vSphere Client security vulnerabilities

vCenter Server 4.1 Update 1

vCenter Server 4.0 Update 3

VirtualCenter Server 2.5 Update 6a

ESXi 4.0

ESX 4.0

Related