The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SSL Sessions Not Authenticated By VMware VC Clients
------------------------------------------------------------------------
SUMMARY
VMware VirtualCenter client does not verify the server's X.509 certificate
when creating an SSL session, which allows remote malicious servers to
spoof valid servers via a man-in-the-middle attack.
DETAILS
Vulnerable Systems:
* VMware VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643)
* VMware VirtualCenter client 1.4.x before 1.4.1 Patch 1 (Build 33425)
To ensure a secure channel of communication, you must be sure that any
communication is with "trusted" sites whose identity you can be sure of.
Both the client and server need certificates from a mutually-trusted
Certificate Authority (CA).
However, certificate verification is not enabled by default for the
clients. After installing VirtualCenter 2.0.1 Patch 1 or VirtualCenter
1.4.1 Patch 1, you must specifically enable server-certificate
verification on theWindows client hosts.
VirtualCenter 2.0.1 Patch 1 and VirtualCenter 1.4.1 Patch 1 resolve an
issue with server-certificate verification by VirtualCenter clients during
the initial SSL handshake. Specifically, the x.509 certificate presented
by a server to a client at the beginning of an SSL session is not
verified. VirtualCenter 2.0.1 Patch 1 and VirtualCenter 1.4.1 Patch 1
resolve this issue for Windows client hosts.
Solution:
Note that installing the updated software does not, by default, enable
authentication. For information about how to enable this new optional
capability, see Knowledge Base (KB) article 4646606, "
<http://kb.vmware.com/kb/4646606 > Enabling Server- Certificate
Verification for Virtual Infrastructure Clients."
Client hosts include:
* VirtualCenter Server host, which operates as a client to each of the
servers that it manages;
VirtualCenter Server 2.x:
* Virtual Infrastructure Client (VI Client, or VIC), client software that
lets you connect to and manage ESX Server hosts directly, or through a
VirtualCenter Server host;
VirtualCenter Server 1.x:
* VirtualCenter Client (VC Client), client software that lets you connect
to and manage ESX Server 2.x hosts through a VirtualCenter Server host
(1.x version).
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5990>
CVE-2006-5990
ADDITIONAL INFORMATION
The information has been provided by vmware.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
