VMware View Connection Server Directory Traversal

By Fortra's Digital Defense

DDIVRT-2012-48 VMware View Connection Server Directory Traversal (CVE-2012-5978)

Follow us on Twitter!


Date Discovered
September 26, 2012

Discovered By
Digital Defense, Inc. Vulnerability Research Team
Credit: r@b13$

Vulnerability Description
The tunnel-server component of the VMware View Connection Server fails to ensure that  each requested URL refers to a file that is both located within the web root of the server and is of a type that is allowed to be served.

A remote unauthenticated attacker can use this weakness to retrieve arbitrary files from the affected server's underlying root file system. This can be accomplished by submitting URL encoded HTTP GET requests that traverse out of the affected subdirectory.

Solution Description
VMware has produced a solution for the issue in the form of an upgrade which is available through their website. The VMware advisory can be found: https://www.vmware.com/security/advisories/VMSA-2012-0017.html

Vulnerable Software
VMware View 5.x prior to version 5.1.2
VMware View 4.x prior to version 4.6.2

Vendor Contact
Vendor Name: VMware, Inc.
Vendor Website: https://www.vmware.com/

Share This