VMware vFabric tc Server JMX Authentication Security Bypass Vulnerability

Bugtraq ID:	49122
Class:	Unknown
CVE:	CVE-2011-0527
Remote:	Yes
Local:	No
Published:	Aug 11 2011 12:00AM
Updated:	Aug 11 2011 12:00AM
Credit:	SpringSource tc Server support team
Vulnerable:	VMWare vFabric tc Server 2.1.1.SR01 VMWare vFabric tc Server 2.1.1 VMWare vFabric tc Server 2.1.0 VMWare vFabric tc Server 2.0.5.SR01 VMWare vFabric tc Server 2.0.5 VMWare vFabric tc Server 2.0.0
Not Vulnerable:	VMWare vFabric tc Server 2.1.2 VMWare vFabric tc Server 2.0.6

VMware vFabric tc Server JMX Authentication Security Bypass Vulnerability

The VMware vFabric tc Server is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access, which may lead to further attacks.

The following versions are vulnerable:

vFabric tc Server 2.0.0 through 2.0.5.SR01
vFabric tc Server 2.1.0.through 2.1.1.SR01

VMware vFabric tc Server JMX Authentication Security Bypass Vulnerability

An attacker can use readily available tools to exploit this issue.

VMware vFabric tc Server JMX Authentication Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

VMware vFabric tc Server JMX Authentication Security Bypass Vulnerability

References:

• CVE-2011-0527: vFabric tc Server password obfuscation bypass (SpringSource)
  
• Product Homepage (Vmware)