CVE-2010-1454: Medium severity VMware tc Server vulnerability

Published May 19, 2010

Updated

com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password.

Affected Software

7 affected components

VMware tc Server=6.0.19

VMware tc Server=6.0.19.a

VMware tc Server=6.0.20

VMware tc Server=6.0.20.a

VMware tc Server=6.0.20.b

VMware tc Server=6.0.20.c

VMware tc Server=6.0.25.a

Event History

May 19, 2010

CVE Published

via MITRE·06:13 PM

Data Sourced

via MITRE·06:13 PM

Description

Data Sourced

via NVD·06:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1454?

CVE-2010-1454 is considered a high severity vulnerability due to its potential for allowing unauthorized remote access to JMX resources.

How do I fix CVE-2010-1454?

To fix CVE-2010-1454, upgrade VMware SpringSource tc Server to version 6.0.20.D or later, or 6.0.25.A-SR01 or later.

What software is affected by CVE-2010-1454?

CVE-2010-1454 affects VMware SpringSource tc Server versions 6.0.19, 6.0.20, and 6.0.25.A before 6.0.25.A-SR01.

What type of attack can exploit CVE-2010-1454?

CVE-2010-1454 can be exploited by remote attackers to obtain sensitive information from JMX interfaces without proper encryption.

Is user intervention required to exploit CVE-2010-1454?

No, CVE-2010-1454 can be exploited remotely without user interaction, making it particularly dangerous.