The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the open-vm- tools-12.2.0-3.el9 build changelog.

  - authentication bypass vulnerability in the vgauth module [rhel-br-9]) (CVE-2023-20867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2530-1 advisory.

  - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3945 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: authentication bypass vulnerability in the vgauth module (CVE-2023-20867)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3947 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: authentication bypass vulnerability in the vgauth module (CVE-2023-20867)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3950 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: authentication bypass vulnerability in the vgauth module (CVE-2023-20867)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:3948 advisory.

  - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-259 advisory.

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of open-vm-tools installed on the remote host is prior to 12.2.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2139 advisory.

    A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the open package has been released.

The version of AOS installed on the remote host is prior to 6.5.3.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.5.3.7 advisory.

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

  - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18,     17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to     all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. (CVE-2023-21930)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5493 advisory.

  - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

  - A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-     vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine     may be able to elevate their privileges if that target virtual machine has been assigned a more privileged     Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-     public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-     db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . (CVE-2023-20900)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-20b6ac4b6c advisory.

    Package new upstream version of open-vm-tools-12.3.0-22234872.
    Security fix for CVE-2023-20900, CVE-2023-20867

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
191265	CentOS 9 : open-vm-tools-12.2.0-3.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	low
177406	SUSE SLES12 Security Update : open-vm-tools (SUSE-SU-2023:2530-1)	Nessus	SuSE Local Security Checks	2023/6/17	2023/7/14	low
177760	RHEL 8 : open-vm-tools (RHSA-2023:3945)	Nessus	Red Hat Local Security Checks	2023/6/29	2024/11/7	low
177787	RHEL 9 : open-vm-tools (RHSA-2023:3947)	Nessus	Red Hat Local Security Checks	2023/6/29	2024/11/7	low
177788	RHEL 8 : open-vm-tools (RHSA-2023:3950)	Nessus	Red Hat Local Security Checks	2023/6/29	2024/11/7	low
178049	Rocky Linux 9 : open-vm-tools (RLSA-2023:3948)	Nessus	Rocky Linux Local Security Checks	2023/7/8	2023/7/8	low
178533	Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-259)	Nessus	Amazon Linux Local Security Checks	2023/7/20	2024/12/11	low
178539	Amazon Linux 2 : open-vm-tools (ALAS-2023-2139)	Nessus	Amazon Linux Local Security Checks	2023/7/20	2024/12/11	low
203361	Photon OS 4.0: Open PHSA-2023-4.0-0408	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	low
180586	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.5.3.7)	Nessus	Misc.	2023/9/7	2025/7/22	high
181211	Debian DSA-5493-1 : open-vm-tools - security update	Nessus	Debian Local Security Checks	2023/9/11	2023/9/11	high
185181	Fedora 39 : open-vm-tools (2023-20b6ac4b6c)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	high

偵測

搜尋 Plugin

low

low

low

low

low

low

low

low

low

high

high

high