VMware vSphere Data Protection CVE-2014-4632 Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	72367
Class:	Design Error
CVE:	CVE-2014-4632
Remote:	Yes
Local:	No
Published:	Jan 29 2015 12:00AM
Updated:	Feb 04 2015 02:04AM
Credit:	Thorsten Tullmann of the Steinbuch Centre for Computing
Vulnerable:
Not Vulnerable:

VMware vSphere Data Protection CVE-2014-4632 Certificate Validation Security Bypass Vulnerability

VMware vSphere Data Protection is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from a server.

An attacker can exploit this issue to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

VMware vSphere Data Protection 5.1, 5.5 and 5.8 are vulnerable; other versions may also be affected.

VMware vSphere Data Protection CVE-2014-4632 Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

VMware vSphere Data Protection CVE-2014-4632 Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

VMware vSphere Data Protection CVE-2014-4632 Certificate Validation Security Bypass Vulnerability

References:

• VMware Homepage (VMware)