Test ID:	1.3.6.1.4.1.25623.1.0.105393
Category:	VMware Local Security Checks
Title:	VMware ESXi OpenSLP Remote Code Execution (VMSA-2015-0007)
Summary:	VMware vCenter and ESXi updates address critical security issues.
Description:	Summary: VMware vCenter and ESXi updates address critical security issues. Vulnerability Insight: - VMware ESXi OpenSLP Remote Code Execution VMware ESXi contains a double free flaw in OpenSLP's SLPDProcessMessage() function. Exploitation of this issue may allow an unauthenticated attacker to execute code remotely on the ESXi host. - VMware vCenter Server JMX RMI Remote Code Execution VMware vCenter Server contains a remotely accessible JMX RMI service that is not securely configured. An unauthenticated remote attacker that is able to connect to the service may be able use it to execute arbitrary code on the vCenter server. - VMware vCenter Server vpxd denial-of-service vulnerability VMware vCenter Server does not properly sanitize long heartbeat messages. Exploitation of this issue may allow an unauthenticated attacker to create a denial-of-service condition in the vpxd service. Affected Software/OS: VMware ESXi 5.5 without patch ESXi550-201509101 VMware ESXi 5.1 without patch ESXi510-201510101 VMware ESXi 5.0 without patch ESXi500-201510101 Solution: Apply the missing patch(es). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-5177 1033719 http://www.securitytracker.com/id/1033719 76635 http://www.securityfocus.com/bid/76635 DSA-3353 https://www.debian.org/security/2015/dsa-3353 http://sourceforge.net/p/openslp/mercurial/ci/2bc15d0494f886d9c4fe342d23bc160605aea51d/ https://bugzilla.redhat.com/show_bug.cgi?id=1251064 Common Vulnerability Exposure (CVE) ID: CVE-2015-2342 BugTraq ID: 76930 http://www.securityfocus.com/bid/76930 http://seclists.org/fulldisclosure/2015/Oct/1 http://www.zerodayinitiative.com/advisories/ZDI-15-455 https://www.7elements.co.uk/resources/technical-advisories/cve-2015-2342-vmware-vcenter-remote-code-execution/ http://www.securitytracker.com/id/1033720 Common Vulnerability Exposure (CVE) ID: CVE-2015-1047 BugTraq ID: 76932 http://www.securityfocus.com/bid/76932
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.