VMware has acknowledged a weakness and some vulnerabilities in VMware VirtualCenter, which can be exploited by malicious, local users to disclose sensitive information, and by malicious people to bypass certain security restrictions, disclose system information or potentially sensitive information, cause a DoS (Denial of Service), or compromise a vulnerable system.

1) The problem is that the Virtual Infrastructure Client displays the VirtualCenter Server password in cleartext when logging in, if the password contains certain unspecified special characters.

NOTE: The weakness affects only VirtualCenter 2.5.

2) Several vulnerabilities in Sun Java JDK / JRE can be exploited to bypass certain security restrictions, disclose system information or potentially sensitive information, cause a DoS (Denial of Service), or compromise a vulnerable system.

For more information:
SA31010

Solution
VirtualCenter 2.5:
Further details available to Secunia VIM customers

Provided and/or discovered by
1) The vendor credits Mark Woollatt.

Original Advisory
http://www.vmware.com/security/advisories/VMSA-2008-0016.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers