VMware has acknowledged a weakness in VMware vCenter Server, which can be exploited by malicious, local users to disclose sensitive information.

The weakness is caused due to the Apache Tomcat Manager application configuration file containing logon credentials, which can be exploited to disclose the credentials by reading the configuration file.

Solution
Apply vCenter Update 1.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Claudio Criscione, Secure Networking.

Original Advisory
VMSA-2011-0003:
http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Deep Links
Links available to Secunia VIM customers