CVE-2011-0527 VMware vFabric tc Server (aka SpringSource tc Server) 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for contex...
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
VMware vFabric tc Server (aka SpringSource tc Server) 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware tc server | = 2.0.0 | No fix listed |
| VMware tc server | = 2.0.0-sr01 | No fix listed |
| VMware tc server | = 2.0.1 | No fix listed |
| VMware tc server | = 2.0.2 | No fix listed |
| VMware tc server | = 2.0.2-sr01 | No fix listed |
| VMware tc server | = 2.0.2-sr02 | No fix listed |
| VMware tc server | = 2.0.3 | No fix listed |
| VMware tc server | = 2.0.4 | No fix listed |
| VMware tc server | = 2.0.5 | No fix listed |
| VMware tc server | = 2.0.5-sr01 | No fix listed |
| VMware tc server | = 2.1.0 | No fix listed |
| VMware tc server | = 2.1.1 | No fix listed |
| VMware tc server | = 2.1.1-sr01 | No fix listed |
References
- 20110811 CVE-2011-0527: VMware vFabric tc Server password obfuscation bypass mailing-list
- 1025923 vdb-entry
- 49122 vdb-entry
- www.springsource.com vendor-advisory
- tcserver-jmx-sec-bypass(69156) vdb-entry