CVE-2008-3514: Infoleak
First published: Wed Aug 13 2008(Updated: )
VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other system users."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware vCenter | =2.0.2-update_2 | |
| VMware vCenter | =2.0.2-update_3 | |
| VMware vCenter | =2.5-update_1 | |
| VMware vCenter | =2.0.2 | |
| VMware vCenter | <=2.0.2 | |
| VMware vCenter | =2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.vmware.com/support/vi3/doc/releasenotes_vc202u5.html
- http://www.securityfocus.com/bid/30664
- http://secunia.com/advisories/31468
- http://www.vmware.com/security/advisories/VMSA-2008-0012.html
- http://www.insomniasec.com/advisories/ISVA-080812.1.htm
- http://www.securitytracker.com/id?1020693
- http://securityreason.com/securityalert/4150
- http://www.vupen.com/english/advisories/2008/2363
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44425
- http://www.securityfocus.com/archive/1/495386/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-3514?
CVE-2008-3514 has a medium severity rating due to its potential for user credential enumeration.
How do I fix CVE-2008-3514?
To mitigate the risk of CVE-2008-3514, upgrade to VMware VirtualCenter 2.5 Update 2 or later, or 2.0.2 Update 5 or later.
What systems are affected by CVE-2008-3514?
CVE-2008-3514 affects VMware VirtualCenter versions 2.0.2 prior to Update 5 and 2.5 prior to Update 2.
What vulnerability type is CVE-2008-3514?
CVE-2008-3514 is an access control vulnerability that allows attackers to infer valid user names.
Can CVE-2008-3514 lead to further attacks?
Yes, by determining valid user names, CVE-2008-3514 can potentially lead to unauthorized access or further exploitation.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/vmware
- canonical/vmware vcenter
- version/vmware vcenter/2.0.2-update_2
- version/vmware vcenter/2.0.2-update_3
- version/vmware vcenter/2.5-update_1
- version/vmware vcenter/2.0.2
- version/vmware vcenter/2.5