CVE-2015-6932: Medium severity vmware vcenter vulnerability
Published Sep 18, 2015
·Updated
VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected Software
12 affected components
VMware vCenter Server=5.5
VMware vCenter Server=5.5-1
VMware vCenter Server=5.5-1a
VMware vCenter Server=5.5-1b
VMware vCenter Server=5.5-1c
VMware vCenter Server=5.5-2
VMware vCenter Server=5.5-2b
VMware vCenter Server=5.5-2d
VMware vCenter Server=5.5-2e
VMware vCenter Server=6.0
VMware vCenter Server=6.0-a
VMware vCenter Server=6.0-b
Event History
Sep 18, 2015
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-6932?
The severity of CVE-2015-6932 is considered critical due to the potential for man-in-the-middle attacks.
2
How do I fix CVE-2015-6932?
To fix CVE-2015-6932, you should upgrade VMware vCenter Server to version 5.5 U3 or 6.0 U1 or later.
3
What impact does CVE-2015-6932 have on VMware vCenter?
CVE-2015-6932 allows attackers to spoof LDAP servers and obtain sensitive information through unverified X.509 certificates.
4
Which versions of VMware vCenter are affected by CVE-2015-6932?
VMware vCenter Server 5.5 before U3 and 6.0 before U1 are affected by CVE-2015-6932.
5
Is it possible to exploit CVE-2015-6932 remotely?
Yes, CVE-2015-6932 can be exploited remotely by attackers with network access to the LDAP server.