Skip to content
  • Home
  • About
  • Services
    • Vulnerability and Threat Intelligence
    • Threat Modeling and Risk Assessment
    • Penetration Testing
    • Source Code Review
    • Security Research
    • Security Consulting
  • Training
    • Kernel exploitation
      • Training – November 2019 – CLOSED
    • Kernel development
    • Userland exploitation
  • Labs
    • Exploits
    • Publications
    • Security Alerts
      • Latest Security Alerts
      • Latest Modified Security Alerts
      • Latest Ordered Security Alerts
      • Search Security Alert
  • Blog
  • Contact
  • Language
    • English
    • Português

Allele Security Intelligence

Efficient information security services

ASA-2019-00561 – VMware vCenter Server: Information disclosure vulnerability in vAppConfig properties

Posted on October 14, 2019October 21, 2019 by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00561

Identifier(s)

ASA-2019-00561, CVE-2019-5534, VMSA-2019-0013

Title

Information disclosure vulnerability in vAppConfig properties

Vendor(s)

VMware

Product(s)

VMware vCenter Server

Affected version(s)

VMware vCenter Server 6.7 versions before 6.7 U3
VMware vCenter Server 6.5 versions before 6.5 U3
VMware vCenter Server 6.0 versions before 6.0 U3j

Fixed version(s)

VMware vCenter Server 6.7 version 6.7 U3
VMware vCenter Server 6.5 version 6.5 U3
VMware vCenter Server 6.0 version 6.0 U3j

Proof of concept

Unknown

Description

Virtual Machines deployed from an OVF could expose login information via the virtual machine’s vAppConfig properties.

Technical details

Unknown

Credits

Rich Browne (F5 Networks)

Reference(s)

VMSA-2019-0013.1
https://www.vmware.com/security/advisories/VMSA-2019-0013.html

CVE-2019-5534
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5534

CVE-2019-5534
https://nvd.nist.gov/vuln/detail/CVE-2019-5534

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: October 21, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.

Share this:

  • Click to print (Opens in new window)
  • Click to email this to a friend (Opens in new window)
  • Click to share on Facebook (Opens in new window)
  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Twitter (Opens in new window)
  • Click to share on Pocket (Opens in new window)
  • Click to share on Telegram (Opens in new window)
  • Click to share on WhatsApp (Opens in new window)

Like this:

Like Loading...

Related

Tagged ASA-2019-00561, CVE-2019-5534, Information Disclosure, Login Information, Open Virtualization Format (OVF), vAppConfig, VMSA-2019-0013, VMware, VMware vCenter Server

Post navigation

Previous Post ASA-2019-00560 – VMware vCenter Server: Information disclosure vulnerability
Next Post ASA-2019-00562 – VMware ESXi, Workstation, Fusion, Remote Console and Horizon Client: Use-after-free vulnerability in the virtual sound device

Archives

  • September 2020 (10)
  • May 2020 (1)
  • March 2020 (1)
  • February 2020 (5)
  • December 2019 (33)
  • November 2019 (28)
  • October 2019 (54)
  • September 2019 (25)
  • August 2019 (46)
  • July 2019 (77)
  • June 2019 (95)
  • May 2019 (68)
  • April 2019 (77)
  • March 2019 (49)
  • February 2019 (78)
  • January 2019 (36)
  • December 2018 (38)
  • November 2018 (44)
  • October 2018 (20)
  • September 2018 (1)
  • August 2018 (1)

Tags

Apache HTTP Server (13) Apache Software Foundation (19) Arbitrary Code Execution (43) Arbitrary File Read (7) Authenticated User (13) Authentication Bypass (7) BIND (9) BIOS (9) Buffer Overflow (24) Code Execution (11) Command Injection (9) Cross-Site Request Forgery (13) Cross-Site Scripting (42) Cross-Site Scripting (XSS) (49) CSRF (12) curl (11) Das U-Boot (13) Denial of Service (DoS) (113) Deserialization (8) Facebook (11) Firmware (8) FreeBSD (24) Git (9) GitLab (15) Gitlab Community Edition (12) Gitlab Enterprise Edition (13) Go (7) Heap Buffer Overflow (23) IBM (13) IBM Sterling B2B Integrator Standard Edition (7) Improper Permissions (9) Information Disclosure (64) Integer Overflow (20) Intel (40) INTEL-SA-00248 (9) INTEL-SA-00264 (7) Intel Computer Card (7) Intel Computer Stick (7) Intel NUC (10) Intel Open CIT (8) Intel Open Cloud Integrity Technology (8) Jenkins (46) Joomla (10) Kubernetes (12) libssh2 (9) Linux (34) Linux Kernel (46) Local Access (27) MacOS (10) Magento (40) Memory Corruption (23) Memory Leak (13) mfsa2019-21 (21) MikroTik (10) MikroTik RouterOS (8) Mozilla (20) Mozilla Firefox (22) Mozilla Firefox ESR (8) Mozilla Thunderbird (11) NFS (7) NGINX (8) NULL Pointer Dereference (10) OpenBSD (11) OpenSSL (13) Out-Of-Bounds Read (41) Out-Of-Bounds Write (25) PIA (9) PowerDNS (6) Private Internet Access (9) Privilege Escalation (99) Race Condition (12) rdesktop (19) Remote Code Execution (RCE) (64) rubygems (7) Samba (15) Sandbox Bypass (8) Security Bypass (8) Side Channel (8) SQL Injection (7) Stack Buffer Overflow (10) Stored Cross-Site Scripting (14) systemd (7) TCP (10) TYPO3 (32) TYPO3 CMS (7) Unbounded memcpy (7) Use-After-Free (28) VMware (25) VMware ESXI (9) VMware Fusion (8) VMware Workstation (9) WebKit (20) WebKitGTK (20) WhatsApp (9) Windows (12) Wind River (11) Wind River VxWorks (11) WPE Webkit (20) WSA-2019-0003 (20) Xen (8)
  • Twitter
  • Facebook
  • Github
  • Linkedin
  • RSS

Services

Vulnerability and Threat Intelligence

Threat Modeling and Risk Assessment

Penetration Testing

Source Code Review

Security Research

Security Consulting

Training

Kernel exploitation

Kernel development

Userland exploitation

Publications

Redução da superfície de ataque ao kernel do Linux – SEMCOMP 2019

Introdução à pesquisa em vulnerabilidades no núcleo do Linux – EnSI 2018

Introdução à pesquisa em vulnerabilidades no núcleo do Linux – RoadSec Salvador 2018

Rootkits em kernel space – Redshift, um rootkit para o kernel do FreeBSD

Public proofs of concept

CVE-2012-0217

CVE-2012-4576

latest security alerts

  • ASA-2020-00051 – Linux kernel: vsyscall page refcounting error September 16, 2020
  • ASA-2020-00050 – Linux kernel: Use-after-free vulnerability in cgroup BPF component September 16, 2020
  • ASA-2020-00049 – Linux kernel: Kernel stack information leak on s390/s390x platform September 12, 2020

Subscribe to our Blog

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

© 2020 Allele Security Intelligence.
All rights reserved. Privacy Policy.

loading Cancel
Post was not sent - check your email addresses!
Email check failed, please try again
Sorry, your blog cannot share posts by email.
%d bloggers like this: