|
|
|
|
| |
Credit:
The information has been provided by Martin O'Neal.
|
| |
Vulnerable Systems:
* VMware ESX prior to 2.5.2 patch 4
* VMware ESX prior to 2.0.2
Immune Systems:
* VMware ESX prior to 2.5.2 patch 5
* VMware ESX prior to 2.0.3
VMware ESX Server is described as virtual infrastructure software for partitioning, consolidating and managing servers in mission-critical environments.
The software provides a virtualization layer that allows multiple x86 based operating systems to run on the same hardware concurrently. The ESX Server product differs from other VMware products in that it does not require a "host" operating system to be provided by the user. Instead, it uses a custom x86 kernel as the host, along with a customized Linux operating system as a "console O/S".
VMware ESX Server includes a number of network services and a web application, called the "VMware Management Interface" that can be used to perform remote administration of the system.
Analysis:
The Management Interface is a traditional web application, which utilizes a session ID contained within two cookies; vmware.mui.kid and vmware.mui.sid. The Session ID format is proprietary and contains the user account and password in a simple (recursively) base64 encoded format.
If an attacker can gain access to the cookies by any mechanism, such as through a simple cross site scripting attack, then they will acquire not only the session ID, but the authentication credentials as well.
Recommendations:
Upgrade to a version of the VMware ESX product that does not exhibit this issue.
CVE Information:
CVE-2006-2481
|
|
|
|
|
