VDB-2418 · CVE-2005-3618 · SA21230

VMware ESX Server 2.5.3 Upgrade Patch 2 Management Interface

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
7.4$0-$5k0.00

Summaryinfo

A vulnerability labeled as critical has been found in VMware ESX Server 2.5.3 Upgrade Patch 2. This impacts an unknown function of the component Management Interface. The manipulation results in an unknown weakness. This vulnerability was named CVE-2005-3618. There is no available exploit. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in VMware ESX Server 2.5.3 Upgrade Patch 2 (Virtualization Software). It has been classified as critical. Affected is an unknown part of the component Management Interface. This is going to have an impact on confidentiality, and integrity. CVE summarizes:

Cross-site request forgery (CSRF) vulnerability in the management interface for VMware ESX Server 2.0.x before 2.0.2 patch 1, 2.1.x before 2.1.3 patch 1, and 2.x before 2.5.3 patch 2 allows allows remote attackers to perform unauthorized actions as the administrator via URLs, as demonstrated using the setUsr operation to change a password. NOTE: this issue can be leveraged with CVE-2005-3619 to automatically perform the attacks.

The weakness was presented 08/01/2006 by Stephen de Vries and Martin O'Neal with Corsaire (Website). The advisory is available at corsaire.com. This vulnerability is traded as CVE-2005-3618 since 11/16/2005. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at vmware.com.

The vulnerability is also documented in the databases at Secunia (SA21230†) and SecurityTracker (ID 1016612†). See VDB-2416, VDB-2417, VDB-27879 and VDB-31563 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

Vendor

Name

Version

License

Website

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 8.2
VulDB Meta Temp Score: 7.4

VulDB Base Score: 8.2
VulDB Temp Score: 7.4
VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Exploitinginfo

Class: Unknown
CWE: Unknown
CAPEC: 🔍
ATT&CK: 🔍

Physical: No
Local: No
Remote: Yes

Availability: 🔍
Status: Proof-of-Concept

EPSS Score: 🔍
EPSS Percentile: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Patch
Status: 🔍
Patch: vmware.com

Timelineinfo

11/16/2005 🔍
12/31/2005 +45 days 🔍
07/31/2006 +212 days 🔍
08/01/2006 +1 days 🔍
08/02/2006 +1 days 🔍
03/13/2021 +5337 days 🔍

Sourcesinfo

Vendor: vmware.com

Advisory: corsaire.com
Researcher: Stephen de Vries, Martin O'Neal
Organization: Corsaire
Status: Not defined
Confirmation: 🔍

CVE: CVE-2005-3618 (🔍)
GCVE (CVE): GCVE-0-2005-3618
GCVE (VulDB): GCVE-100-2418
Secunia: 21230 - VMware ESX Server Multiple Vulnerabilities, Less Critical
SecurityTracker: 1016612 - VMware ESX Server URL-Based Password Change Function May Let Remote Users Change a Target User's Password in Certain Cases
Vupen: ADV-2006-3075

scip Labs: https://www.scip.ch/en/?labs.20060413
See also: 🔍

Entryinfo

Created: 08/02/2006 11:02
Updated: 03/13/2021 11:17
Changes: 08/02/2006 11:02 (57), 12/02/2015 10:55 (6), 03/13/2021 11:17 (8)
Complete: 🔍
Cache ID: 216:BB3:103

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!