Patch the VMware Client Integration Plugin asap

VMware issued a security update to fix a critical vulnerability in the VMware Client Integration Plugin, apply it as soon as possible.

VMware issued a Security Advisory related to a critical security vulnerability (CVE-2016-2076) in the VMware Client Integration Plugin urging administrators to urgently apply the needed patch.

The flaw could be exploited by attackers to launch a Man in the Middle attack or Web session hijacking under certain conditions. The problem resides in the way the VMware Client Integration Plugin handles session content.

“The VMware Client Integration Plugin does not handle session content in a safe way. This may allow for a Man in the Middle attack or Web session hijacking in case the user of the vSphere Web Client visits a malicious Web site.” states the VMware advisory.

VMware Client Integration Plugin

The vulnerability affects the following versions of the VMware Client Integration Plugin shipped with:

vCenter Server 6.0 (any 6.0 version up to 6.0 U2)
vCenter Server 5.5 U3a, U3b, U3c
vCloud Director 5.5.5
vRealize Automation Identity Appliance 6.2.4

The experts at VMware highlighted that in order to solve the issue, both the server side (i.e. vCenter Server, vCloud Director, and vRealize Automation Identity Appliance)
and the client side (i.e. CIP of the vSphere Web Client) need to be updated.

Below the procedure to install the security updates:

A) Install an updated version of:
– vCenter Server
– vCloud Director
– vRealize Automation Identity Appliance
B) After step A), update the Client Integration Plugin on the system
from which the vSphere Web Client is used.
Updating the plugin on vSphere and vRA Identity Appliance is
explained in VMware Knowledge Base article 2145066.
Updating the plugin on vCloud Director is initiated by a prompt
when connecting the vSphere Web Client to the updated version of
vCloud Director.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – VMware, Virtualization)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.