Secunia

Corsaire has reported some vulnerabilities in VMware ESX Server, which can be exploited to gain knowledge of potentially sensitive information or conduct cross-site request forgery attacks.

1) When changing passwords using the management interface, the GET request containing the password in clear text is logged to a world-readable file.

2) The management interface uses a proprietary session ID format containing authentication credentials encoded in base64. If malicious people get hold of the session cookies, it's possible to gain knowledge of the user account and password.

3) The management interface allows users to perform certain actions via HTTP GET requests without performing any validity checks to verify the user's request. This can be exploited to change a user's password when user visits a malicious web site while logged in.

Solution
According to the researchers, the vulnerabilities have been fixed in version 2.5.3 Upgrade Patch 2, 2.1.3 Upgrade Patch 1, and 2.0.2 Upgrade Patch 1.

Provided and/or discovered by
Stephen de Vries og Martin O'Neal, Corsaire.

Changelog
Further details available in Customer Area

Original Advisory
http://www.corsaire.com/advisories/c060512-001.txt
http://www.corsaire.com/advisories/c051114-001.txt
http://www.corsaire.com/advisories/c051114-003.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area