Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title VMware vCenter, ESX patch and vCenter Lab Manager releases address cross-site scripting issues
Informations
Name VMSA-2009-0017 First vendor Publication 2009-12-15
Vendor VMware Last vendor Modification 2009-12-15
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

a. WebWorks Help - Cross-site scripting vulnerability

WebWorks Help is an output format that allows online Help to be delivered on multiple platforms and browsers, which makes it easy to publish information on the Web or on an enterprise intranet. WebWorks Help is used for creating the online help pages that are available in VMware WebAccess, Lab Manager and Stage Manager.

WebWorks Help doesn't sufficiently sanitize incoming requests which may result in cross-site scripting vulnerabilities in applications that are built with WebWorks Help.

Exploitation of these vulnerabilities in VMware products requires tricking a user to click on a malicious link or to open a malicious web page while they are logged in into vCenter, ESX or VMware Server using WebAccess, or logged in into Stage Manager or Lab Manager.

Successful exploitation can lead to theft of user credentials. These vulnerabilities can be exploited remotely only if the attacker has access to the Service Console network.

Security best practices provided by VMware recommend that the Service Console be isolated from the VM network. Please see http://www.vmware.com/resources/techresources/726 for more information on VMware security best practices.

Client-side protection measures included with current browsers are not always able to prevent these attacks from being executed.

VMware would like to thank Daniel Grzelak and Alex Kouzemtchenko of stratsec (www.stratsec.net) for finding and reporting this issue. VMware would also like to thank Ben Allums of WebWorks.com for working on the remediation of this issue with us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-3731 to this issue.

Original Source

Url : http://www.vmware.com/security/advisories/VMSA-2009-0017.html

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:5944
 
Oval ID: oval:org.mitre.oval:def:5944
Title: VMware vCenter, ESX patch and vCenter Lab Manager cross-site scripting issues
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3731
Version: 5
Platform(s): VMWare ESX Server 4.0
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Application 1
Application 1
Application 4
Application 1
Application 10
Application 4
Application 4

OpenVAS Exploits

Date Description
2009-12-21 Name : VMware Server Multiple Cross-Site Scripting Vulnerabilities (Linux)
File : nvt/secpod_vmware_server_mult_xss_vuln_dec09_lin.nasl
2009-12-21 Name : VMware Server Multiple Cross-Site Scripting Vulnerabilities (Win)
File : nvt/secpod_vmware_server_mult_xss_vuln_dec09_win.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
62742 CA SiteMinder WebWorks Help wwhelp/wwhimpl/common/html/bookmark.htm Unspecifi...

62741 CA SiteMinder WebWorks Help wwhelp/wwhimpl/common/scripts/switch.js Unspecifi...

62740 CA SiteMinder WebWorks Help wwhelp/wwhimpl/common/html/frameset.htm Unspecifi...

62739 CA SiteMinder WebWorks Help wwhelp/wwhimpl/api.htm Unspecified Parameter XSS

62738 CA SiteMinder WebWorks Help wwhelp_entry.html Unspecified Parameter XSS

61308 VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/common/html/book...

61307 VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/common/scripts/s...

61306 VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/common/html/fram...

61305 VMware vCenter Lab Manager WebWorks Help Page wwhelp/wwhimpl/api.htm XSS

61049 VMware vCenter Lab Manager WebWorks Help Page wwhelp_entry.html XSS

Nessus® Vulnerability Scanner

Date Description
2016-03-03 Name : The remote host is missing a security-related patch.
File : vmware_VMSA-2009-0017_remote.nasl - Type : ACT_GATHER_INFO
2014-11-26 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2009-0017.nasl - Type : ACT_GATHER_INFO
2011-02-17 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2009-0017.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2016-03-04 13:26:25
  • Multiple Updates
2014-11-27 13:28:43
  • Multiple Updates
2014-02-17 12:07:14
  • Multiple Updates
2013-12-14 21:19:31
  • Multiple Updates