VMware vSphere Data Protection CVE-2018-11066 Remote Code Execution Vulnerability

Bugtraq ID:	105968
Class:	Input Validation Error
CVE:	CVE-2018-11066
Remote:	Yes
Local:	No
Published:	Nov 20 2018 12:00AM
Updated:	Nov 20 2018 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	VMWare vSphere Data Protection 6.1.6 VMWare vSphere Data Protection 6.1.5 VMWare vSphere Data Protection 6.1.4 VMWare vSphere Data Protection 6.1 VMWare vSphere Data Protection 6.0.7 VMWare vSphere Data Protection 6.0.6 VMWare vSphere Data Protection 6.0.5 VMWare vSphere Data Protection 6.0
Not Vulnerable:	VMWare vSphere Data Protection 6.1.10 VMWare vSphere Data Protection 6.0.9

VMware vSphere Data Protection CVE-2018-11066 Remote Code Execution Vulnerability

VMware vSphere Data Protection is prone to a remote code-execution vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions.

VMware vSphere Data Protection CVE-2018-11066 Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

VMware vSphere Data Protection CVE-2018-11066 Remote Code Execution Vulnerability

References:

• VMware Homepage (VMware)
  
• VMSA-2018-0029: vSphere Data Protection (VDP) updates address multiple security (VMware)