Description
The Update Installer in VMware ESXi 4.1, when a modified sfcb.cfg is present, does not properly configure the SFCB authentication mode, which allows remote attackers to obtain access via an arbitrary username and password.
References
- 20101221 VMSA-2010-0020 VMware ESXi 4.1 Update Installer SFCB Authentication Flaw mailing-list
- http://www.vmware.com/security/advisories/VMSA-2010-0020.html
- 1024917 vdb-entry
- 45543 vdb-entry
- [security-announce] 20101221 VMSA-2010-0020 VMware ESXi 4.1 Update Installer SFCB Authentication Flaw mailing-list
- ADV-2010-3303 vdb-entry
- 42591 third-party-advisory
- http://kb.vmware.com/kb/1031761