CVE-2016-5331: CRLF Injection
First published: Mon Aug 08 2016(Updated: )
CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware vCenter | <=6.0 | |
| VMware ESXi | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/138211/VMware-vSphere-Hypervisor-ESXi-HTTP-Response-Injection.html
- http://seclists.org/fulldisclosure/2016/Aug/38
- http://www.securityfocus.com/archive/1/539128/100/0/threaded
- http://www.securityfocus.com/bid/92324
- http://www.securitytracker.com/id/1036543
- http://www.securitytracker.com/id/1036544
- http://www.securitytracker.com/id/1036545
- http://www.vmware.com/security/advisories/VMSA-2016-0010.html
Frequently Asked Questions
What is the severity of CVE-2016-5331?
CVE-2016-5331 is considered a medium severity vulnerability.
How do I fix CVE-2016-5331?
To fix CVE-2016-5331, update VMware vCenter Server to version 6.0 update 2 or later, or update ESXi to a non-vulnerable version.
What systems are affected by CVE-2016-5331?
CVE-2016-5331 affects VMware vCenter Server versions prior to update 2 and VMware ESXi version 6.0.
What type of attack can be executed using CVE-2016-5331?
CVE-2016-5331 allows attackers to perform HTTP response splitting attacks by injecting arbitrary HTTP headers.
Is there a workaround for CVE-2016-5331 if I cannot update?
There are no documented workarounds for CVE-2016-5331, so updating to a secure version is recommended.
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vmware
- canonical/vmware vcenter
- version/vmware vcenter/6.0
- canonical/vmware esxi
- version/vmware esxi/6.0