VMware vCenter Server CVE-2014-8371 Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	71493
Class:	Design Error
CVE:	CVE-2014-8371
Remote:	Yes
Local:	No
Published:	Dec 04 2014 12:00AM
Updated:	Dec 04 2014 12:00AM
Credit:	The Google Security Team
Vulnerable:	VMWare vCenter Server 5.5 VMWare vCenter Server 5.1 VMWare vCenter Server 5.0
Not Vulnerable:	VMWare vCenter Server 5.5 Update 2 VMWare vCenter Server 5.1 Update 3 VMWare vCenter Server 5.0 Update 3c

VMware vCenter Server CVE-2014-8371 Certificate Validation Security Bypass Vulnerability

vCenter Server is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from a server.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

VMware vCenter Server CVE-2014-8371 Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

VMware vCenter Server CVE-2014-8371 Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

VMware vCenter Server CVE-2014-8371 Certificate Validation Security Bypass Vulnerability

References:

• vCenter Server Appliance Product Page (VMware)
  
• VMware Homepage (VMware)
  
• VMware Security Advisories Security VMSA-2014-0012 (VMware)