This entry was posted in Security Advice, Security Vulnerabilities and tagged Corporate Security, VMware, VMware CIP, VMware Client Integration Plugin, VMware vCenter Server, VMware vCloud Director, VMware vRealize Automation Identity Appliance on Apby JimC_Security.
Client Integration Plugin (CIP) of the vSphere Web Client) that communicate during a session must be separately updated to protect against this issue.Ī step by install checklist to perform these updates for the affected products is also provided in the above mentioned advisory. vCenter Server, vCloud Director, and vRealize Automation Identity Appliance) and client side devices (i.e. In the latter half of last week VMware released security updates for the following products: vCenter Server v6.0 (prior to 6.0 U2) vCenter Server 5.5 U3a U3c vCloud Director version 5.5.5 for Windows vRealize Automation Identity Appliance version 6.2. Please note that both the server side (namely (i.e. Please refer to VMware’s security advisory to download the necessary updates. VMware have released updates to resolve this issue within the affected products.
How Can I Protect Myself From This Issue? This issue could also result in the session between the client and the server becoming hijacked if the user of the vSphere Web Client were to visit a malicious website. If an attacker were to successfully exploit this issue it may lead to the disclosure of the information within the client session between the server (as a result of the man-in-the-middle-attack). Why Should This Issue Be Considered Important? This issue was assigned the CVE number ( defined) CVE-2016-2076 VMware Client integration Plug-in VMware vSphere Web Client : VMware vSphere Web Client - vCenter - Datacenter - host name. These updates resolve a potential man-in-the-middle-attack (MiTM)( defined) that is caused by an error in how the VMware Client Integration Plugin handles session content.