VMware patched information disclosure vulnerabilities in several of the company’s products.
One of the advisories describes three important flaws affecting VMware vCenter Server, vSphere Client and vRealize Automation.
Researchers from Positive Technologies discovered XML External Entity (XXE) vulnerabilities that can lead to information disclosure and, in some cases, to a denial-of-service (DoS) condition.
One issue stems from a single sign-on functionality, while another affects the Log Browser, the Distributed Switch setup and the Content Library. An attacker can exploit the flaws using specially crafted XML requests sent to the server.
The third XXE bug impacts the vSphere Client and it can end up leveraged if the attacker can trick a legitimate user into connecting to a malicious vCenter Server or ESXi instance.
The security holes, tracked as CVE-2016-7458, CVE-2016-7459 and CVE-2016-7460, ended up patched with the release of vSphere Client 6.0 U2s and 5.5 U3e, vCenter Server 6.0 U2s and 5.5 U3e, and vRealize Automation 6.2.5. In the case of vSphere Client, VMware recommends uninstalling the application and reinstalling a patched version.
The second advisory published by VMware describes CVE-2016-5334, a moderate-severity information disclosure flaw in Identity Manager and vRealize Automation.
VMware said the weakness, which is similar to a directory traversal, can allow an attacker to only access folders that don’t contain any sensitive data.
The security holes have been fixed in Identity Manager 2.7.1 and vRealize Automation 7.2.0. vRealize Automation 7.x suffers from this bug as it includes an RPM-based version of Identity Manager.