?
Solved

VMWare vCenter vulnerability help

Posted on 2014-01-30
2
Medium Priority
?
645 Views
Last Modified: 2014-02-05
I had a vulnerability scan done recently and I'm having trouble finding any information on 1 of the items. My setup is ESXi 5.1 with vCenter Server running on Win2008 R2 SP1.

Web Server Internal IP address or network name available
CVE: CVE-2000-0649 CVE-2002-0419
Location: http://localhost:9090/vsphere-client
Impact: An attacker could determine information about your internal network structure from information in http headers.


Seems like there is some sort of http hearer leak of some kind. I was flagged for a few other vCenter items on port 9090 but I was able to find a VMware KB article which states that "there is no potential to obtain sensitive data from this exploit". I realize that port 9090 and 9443 is needed for the Web Client. Anyone have any info on this?? Thanks a lot.
0
Comment
Question by:cb_it
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 28

Accepted Solution

by:
asavener earned 2000 total points
ID: 39821749
Connecting to the server on 9090 should just redirect you to the SSL-protected site (on port 9443).

If you were actually administering the server over 9090, then a bad guy could sniff your username and password.

Since it's just a redirection, no sensitive information is exposed.
0
 
LVL 123
ID: 39821930
AS it's a vCenter Application, or possibly Apache Web Engine, are you running the latest vCenter Server for 5.1.

if you are, you would need to discuss this security issues with VMware Support for Guidance, if they believe it is a security threat, and could be a false postiive provided by the scanner,
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Last article we focus in how to VMware: How to create and use VMs TAGs – Part 1 so before follow this article and perform the next tasks, you should read the first article how to create the TAG before using them in Veeam Backup Jobs.
HOW TO: Connect to the VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere (HTML5 Web) Host Client 6.5, and perform a simple configuration task of adding a new VMFS 6 datastore.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This Micro Tutorial steps you through the configuration steps to configure your ESXi host Management Network settings and test the management network, ensure the host is recognized by the DNS Server, configure a new password, and the troubleshooting…

718 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question