VMWare

UPDATE: VMSA-2015-0009.2 VMware product updates address a critical deserialization vulnerability

Leave a comment 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID: VMSA-2015-0009.2
Synopsis:    VMware product updates address a critical deserialization
             vulnerability
Issue date:  2015-12-18
Updated on:  2016-03-15
CVE number:  CVE-2015-6934

- ------------------------------------------------------------------------

1. Summary

   VMware product updates address a critical deserialization
   vulnerability

2. Relevant Releases

   vRealize Orchestrator 6.x
   vCenter Orchestrator 5.x
   vRealize Infrastructure Navigator 5.8.x

3. Problem Description

   a. Deserialization vulnerability

   A deserialization vulnerability involving Apache Commons-collections
   and a specially constructed chain of classes exists. Successful
   exploitation could result in remote code execution, with the
   permissions of the application using the Commons-collections library.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
   assigned the identifier CVE-2015-6934 to this issue.

   Column 4 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is
   available.

   VMware                         Product    Running   Replace with/
   Product                        Version    on        Apply Patch
   =====================          =======    =======   =================
   vRealize Orchestrator          7.0        Any       Not Affected
   vRealize Orchestrator          6.x        Any       See KB2141244
   vCenter Orchestrator           5.x        Any       See KB2141244

   vRealize Operations            6.x        Windows   6.2 *
   vCenter Operations             5.x        Windows   Patch Pending *

   vCenter Application            7.x        Any       Patch Pending *
   Discovery Manager (vADM)

   vRealize Infrastructure        5.8.x      Linux     5.8.5
   Navigator

   * Exploitation of the issue on vRealize Operations, vCenter
     Operations, and vCenter Application Discovery Manager is limited to
     local privilege escalation.

4. Solution

   Please review the patch/release notes for your product and
   version and verify the checksum of your downloaded file.

   vRealize Orchestrator 6.x and
   vCenter Orchestrator 5.x
   Downloads and Documentation:
   http://kb.vmware.com/kb/2141244

   vRealize Operations 6.x
   Release Notes
  
http://pubs.vmware.com/Release_Notes/en/vrops/62/vrops-62-release-notes.htm
l

   vRealize Infrastructure Navigator 5.8.5
   Release Notes
   http://pubs.vmware.com/Release_Notes/en/vin/585/releasenotes-vin585.html


5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6934

- ------------------------------------------------------------------------

6. Change log

   2015-12-18 VMSA-2015-0009
   Initial security advisory in conjunction with the release of vRealize
   Orchestrator 6.x and vCenter Orchestrator 5.x patches on 2015-12-18.

   2016-01-29 VMSA-2015-0009.1
   Updated security advisory in conjunction with the release of vRealize
   Operations 6.2 on 2016-01-28. Added a note below the table in
   section 3.a that exploitation of this issue in vCenter Application
   Discovery Manager is limited to local privilege escalation.

   2016-03-15 VMSA-2015-0009.2
   Updated security advisory to reflect the release of vRealize
   Infrastructure Navigator 5.8.5, which addresses CVE-2015-6934.

- ------------------------------------------------------------------------

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

    security-announce at lists.vmware.com
    bugtraq at securityfocus.com
    fulldisclosure at seclists.org

   E-mail: security at vmware.com
   PGP key at: http://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   Consolidated list of VMware Security Advisories
   http://kb.vmware.com/kb/2078735

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Support Phases
   https://www.vmware.com/support/policies/lifecycle.html

   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2015 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8

wj8DBQFW6Fs4DEcm8Vbi9kMRAmQFAKDFI6Ij60rfu0ruRd+/SglVGh3E/QCdGJJJ
D27ELmdZmRq4mzpxkRqlXw8=
=hUe6
-----END PGP SIGNATURE-----

Leave a Reply