CVE-2006-5990: Input Validation

Published Nov 21, 2006

Updated

VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425), when server certificate verification is enabled, does not verify the server's X.509 certificate when creating an SSL session, which allows remote malicious servers to spoof valid servers via a man-in-the-middle attack.

Affected Software

2 affected components

VMware VirtualCenter=2.0.1

VMware VirtualCenter=1.4.1

Remediation

Patch Available

http://www.vmware.com/download/vi/vc-201-200611-patch.html

Event History

Nov 21, 2006

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·01:07 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2006-5990?

CVE-2006-5990 is classified as a high-severity vulnerability due to its potential for remote exploitation.

How do I fix CVE-2006-5990?

To fix CVE-2006-5990, upgrade to VMware VirtualCenter 2.0.1 Patch 1 or 1.4.1 Patch 1.

What are the affected versions in CVE-2006-5990?

The affected versions in CVE-2006-5990 include VMware VirtualCenter 2.0.1 before Patch 1 and 1.4.1 before Patch 1.

Can CVE-2006-5990 lead to man-in-the-middle attacks?

Yes, CVE-2006-5990 allows remote malicious servers to potentially spoof valid servers, facilitating man-in-the-middle attacks.

Is server certificate verification important in CVE-2006-5990?

Yes, server certificate verification is crucial to ensure that the connection is made to a legitimate server, which CVE-2006-5990 fails to enforce.