NVD Vulnerability Detail

CVE-2008-3514

Summary	VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other system users."
Summary	Patch information with appropriate login and password: http://www.vmware.com/security/advisories/VMSA-2008-0012.html 4. Solution Please review the patch/release notes for your product and version and verify the md5sum of your downloaded file. VirtualCenter ------------- VMware VirtualCenter 2.5 Update 2 build 104263 www.vmware.com/download/download.do DVD iso image md5sum: 83de404fa073bc1fde9acd080f21e688 Zip file md5sum: 3297f1e47c6b018ac8190f11bd022d5b Release Notes www.vmware.com/support/vi3/doc/vi3_esx35u2_vc25u2_rel_notes.html VMware VirtualCenter 2.0.2 Update 5 build 104182 www.vmware.com/downloads/download.do DVD iso image md5sum: 5fee5d2d97b482e0d0cb47da7d8e7c34 Zip file md5sum: cd468aab309745c12ee5516652aafbcb Release Notes www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
Publication Date	Aug. 13, 2008, 9:42 p.m.
Registration Date	Jan. 29, 2021, 1:40 p.m.
Last Update	Oct. 12, 2018, 5:48 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:vmware:virtualcenter:2.0.2:::::::*
cpe:2.3:a:vmware:virtualcenter:2.0.2:update_2::::::
cpe:2.3:a:vmware:virtualcenter:2.0.2:update_3::::::
cpe:2.3:a:vmware:virtualcenter::update_4::::::*		2.0.2
cpe:2.3:a:vmware:virtualcenter:2.5:::::::*
cpe:2.3:a:vmware:virtualcenter:2.5:update_1::::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://secunia.com/advisories/31468	SECUNIA	Vendor Advisory
2	http://securityreason.com/securityalert/4150	SREASON
3	http://www.insomniasec.com/advisories/ISVA-080812.1.htm	MISC
4	http://www.securityfocus.com/archive/1/495386/100/0/threaded	BUGTRAQ
5	http://www.securityfocus.com/bid/30664	BID
6	http://www.securitytracker.com/id?1020693	SECTRACK
7	http://www.vmware.com/security/advisories/VMSA-2008-0012.html	CONFIRM	Patch Vendor Advisory
8	http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html	CONFIRM
9	http://www.vupen.com/english/advisories/2008/2363	VUPEN	Vendor Advisory
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/44425	XF

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

VMware VirtualCenter における他のシステムユーザに権限を割り当てられる脆弱性

Title	VMware VirtualCenter における他のシステムユーザに権限を割り当てられる脆弱性
Summary	VMware VirtualCenter は、クライアントサイドのアクセスコントロールの有効/無効機能に依存するため、 GUI を有効にすることにより、ユーザ名を見つけ出され、他のシステムユーザに権限を割り当てられる脆弱性が存在します。
Possible impacts	第三者により、有効なユーザ名を見つけ出され、他のシステムユーザに権限を割り当てられる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 12, 2008, midnight
Registration Date	Sept. 13, 2010, 4:03 p.m.
Last Update	Sept. 13, 2010, 4:03 p.m.

Affected System

VMware

VMware VirtualCenter 2.0.2

VMware VirtualCenter 2.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-3514	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3514
National Vulnerability Database (NVD)
2	CVE-2008-3514	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3514

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Release Notes
1	releasenotes_vc202u5	http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
VMware Security Advisories
2	VMSA-2008-0012	http://www.vmware.com/security/advisories/VMSA-2008-0012.html

その他

No	Name	URL
ISS X-Force Database
1	44425	http://xforce.iss.net/xforce/xfdb/44425
Secunia Advisory
2	SA31468	http://secunia.com/advisories/31468
SecurityFocus
3	30664	http://www.securityfocus.com/bid/30664
SecurityTracker
4	1020693	http://www.securitytracker.com/id?1020693
VUPEN Security
5	VUPEN/ADV-2008-2363	http://www.vupen.com/english/advisories/2008/2363

Change Log

No	Changed Details	Date of change
0	[2010年09月13日] 掲載	Feb. 17, 2018, 10:37 a.m.