VMware vCenter Server up to 6.0 U2/6.5 U2/6.7 U2 vAppConfig Credentials insufficiently protected credentials

Summaryinfo

A vulnerability classified as problematic was found in VMware vCenter Server up to 6.0 U2/6.5 U2/6.7 U2. Affected by this vulnerability is an unknown functionality of the component vAppConfig Handler. Executing a manipulation can lead to insufficiently protected credentials (Credentials). This vulnerability appears as CVE-2019-5534. The attack may be performed from remote. There is no available exploit. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in VMware vCenter Server up to 6.0 U2/6.5 U2/6.7 U2 (Server Management Software) and classified as problematic. This vulnerability affects an unknown function of the component vAppConfig Handler. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability (Credentials). The CWE definition for the vulnerability is CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. As an impact it is known to affect confidentiality. CVE summarizes:

VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Machines deployed from an OVF could expose login information via the virtual machine's vAppConfig properties. A malicious actor with access to query the vAppConfig properties of a virtual machine deployed from an OVF may be able to view the credentials used to deploy the OVF (typically the root account of the virtual machine).

The weakness was presented 09/18/2019 (Website). The advisory is shared for download at vmware.com. This vulnerability was named CVE-2019-5534 since 01/07/2019. The attack can be initiated remotely. The successful exploitation requires a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1552.

Applying the patch 6.0 U3j/6.5 U3/6.7 U3 is able to eliminate this problem.

See VDB-141986 and VDB-141987 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Server Management Software

Vendor

• VMware

Name

• vCenter Server

Version

• 6.0 U2
• 6.5 U2
• 6.7 U2

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion