CVE-2014-4632
First published: Sun Feb 01 2015(Updated: )
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certificate.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware vSphere Data Protection | =5.1 | |
| VMware vSphere Data Protection | =5.5.1 | |
| VMware vSphere Data Protection | =5.5.6 | |
| VMware vSphere Data Protection | =5.5.7 | |
| VMware vSphere Data Protection | =5.5.8 | |
| VMware vSphere Data Protection | =5.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-4632?
CVE-2014-4632 is rated as a critical vulnerability due to potential exposure to man-in-the-middle attacks.
How do I fix CVE-2014-4632?
To fix CVE-2014-4632, upgrade to VMware vSphere Data Protection versions 5.5.9 or 5.8.1 or later.
Which versions of VMware vSphere Data Protection are affected by CVE-2014-4632?
CVE-2014-4632 affects VMware vSphere Data Protection versions 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1.
Does CVE-2014-4632 affect EMC Avamar Data Store?
Yes, CVE-2014-4632 also affects EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 6.x and 7.0.x.
What type of attack does CVE-2014-4632 enable?
CVE-2014-4632 enables man-in-the-middle attacks due to improper verification of X.509 certificates.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- agent/author
- agent/first-publish-date
- agent/source
- vendor/vmware
- canonical/vmware vsphere data protection
- version/vmware vsphere data protection/5.1
- version/vmware vsphere data protection/5.5.1
- version/vmware vsphere data protection/5.5.6
- version/vmware vsphere data protection/5.5.7
- version/vmware vsphere data protection/5.5.8
- version/vmware vsphere data protection/5.8.0