-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2016-0001
Synopsis: VMware ESXi, Workstation, Player, and Fusion updates
address important guest privilege escalation vulnerability
Issue date: 2016-01-07
Updated on: 2016-01-07 (Initial Advisory)
CVE number: CVE-2015-6933
1. Summary
VMware ESXi, Fusion, Player, and Workstation updates address
important guest privilege escalation vulnerability
2. Relevant Releases
VMware ESXi 6.0 without patch ESXi600-201512102-SG
VMware ESXi 5.5 without patch ESXi550-201512102-SG
VMware ESXi 5.1 without patch ESXi510-201510102-SG
VMware ESXi 5.0 without patch ESXi500-201510102-SG
VMware Workstation prior to 11.1.2
VMware Player prior to 7.1.2
VMWare Fusion prior to 7.1.2
3. Problem Description
Important Windows-based guest privilege escalation in VMware Tools
A kernel memory corruption vulnerability is present in the VMware Tools
"Shared Folders" (HGFS) feature running on Microsoft Windows. Successful
exploitation of this issue could lead to an escalation of privilege in
the guest operating system.
VMware would like to thank Dmitry Janushkevich from the Secunia
Research Team for reporting this issue to us.
Note: This vulnerability does not allow for privilege escalation from
the guest operating system to the host. Host memory can not be
manipulated from the guest operating system by exploiting this flaw.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the identifier CVE-2015-6933 to this issue.
Workarounds
Removing the "Shared Folders" (HGFS) feature from previously installed
VMware Tools will remove the possibility of exploitation.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch *
============= ======= ======= =================
VMware ESXi 6.0 ESXi
ESXi600-201512102-SG**
VMware ESXi 5.5 ESXi
ESXi550-201512102-SG**
VMware ESXi 5.1 ESXi
ESXi510-201510102-SG**
VMware ESXi 5.0 ESXi
ESXi500-201510102-SG**
VMware Workstation 12.x.x Any not affected
VMware Workstation 11.x.x Any 11.1.2
VMware Player 8.x.x Any not affected
VMware Player 7.x.x Any 7.1.2
VMware Fusion 8.x.x OSX not affected
VMware Fusion 7.x.x OSX 7.1.2
*After the update or patch is applied, VMware Tools must also
be updated in any Windows-based guests that include the "Shared Folders"
(HGFS) feature to resolve CVE-2015-6933.
**VMware Tools installations initiated via vSphere (ESXi/vCenter) do not
include the affected "Shared Folders" (HGFS) feature unless a
"Complete" feature set was specified during the initial installation.
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
VMware ESXi 6.0
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2135123
VMware ESXi 5.5
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2135796
VMware ESXi 5.1
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2126488
VMware ESXi 5.0
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2120210
VMware Workstation 11.1.2
Downloads and Documentation:
https://www.vmware.com/go/downloadworkstation
VMware Player 7.1.2
Downloads and Documentation:
https://www.vmware.com/go/downloadplayer
VMware Fusion 7.1.2
https://www.vmware.com/go/downloadfusion
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6933
- ------------------------------------------------------------------------
6. Change log
2016-01-07 VMSA-2016-0001 Initial security advisory in conjunction
with the release of VMware ESXi 6.0 patches on 2016-01-07.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2016 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8
wj8DBQFWjqPZDEcm8Vbi9kMRAtScAKCLxB7gZbMDVSmIYbwg1K18phVH4QCgsUgL
mOUNFko1gITbZM6kPmiNYh0=
=l6O6
-----END PGP SIGNATURE-----
_______________________________________________
Security-announce mailing list
Security-announce-xEzmwC/hc7si8rCdYzckzA< at >public.gmane.org
http://lists.vmware.com/mailman/listinfo/security-announce
Category Archives: VMWare
VMWare
UPDATE : VMSA-2015-0008.1 – VMware product updates address information disclosure issue
------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0008.1
Synopsis: VMware product updates address information disclosure
issue
Issue date: 2015-11-18
Updated on: 2015-12-18
CVE number: CVE-2015-3269 CVE-2015-5255
------------------------------------------------------------------------
1. Summary
VMware product updates address information disclosure issue.
2. Relevant Releases
VMware vCenter Server 5.5 prior to version 5.5 update 3
VMware vCenter Server 5.1 prior to version 5.1 update u3b
VMware vCenter Server 5.0 prior to version 5.0 update u3e
vCloud Director 5.6 prior to version 5.6.4
vCloud Director 5.5 prior to version 5.5.3
VMware Horizon View 6.0 prior to version 6.1
VMware Horizon View 5.0 prior to version 5.3.4
3. Problem Description
a. vCenter Server, vCloud Director, Horizon View information
disclosure issue.
VMware products that use Flex BlazeDS may be affected by a flaw in
the processing of XML External Entity (XXE) requests. A specially
crafted XML request sent to the server could lead to unintended
information be disclosed.
VMware would like to thank Matthias Kaiser of Code White GmbH for
reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-3269 to this issue.
The product updates listed in the table below have also been
determined to address a XML External Entity (XXE) Processing and
Server Side Request Forgery vulnerability in Flex BlazeDS.
VMware would like to thank James Kettle of PortSwigger Web Security
for reporting these issues to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-5255 to these issues.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
==================== ======= =================
vCenter Server 6.0 any not affected
vCenter Server 5.5 any 5.5 update 3
vCenter Server 5.1 any 5.1 update u3b
vCenter Server 5.0 any 5.5 update u3e
vCloud Director 5.6 any 5.6.4
vCloud Director 5.5 any 5.5.3
Horizon View 6.0 any 6.1
Horizon View 5.3 any 5.3.4
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
vCenter Server
--------------------------------
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
vCloud Director For Service Providers
--------------------------------
Downloads and Documentation:
https://www.vmware.com/support/pubs/vcd_pubs.html
Horizon View 6.1, 5.3.4:
--------------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productId=492
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&productId=396
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5255
------------------------------------------------------------------------
6. Change log
2015-11-18 VMSA-2015-0008
Initial security advisory
2015-12-18 VMSA-2015-0008.1
Updated advisory to note these updates also address CVE-2015-5255
------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
_______________________________________________
Security-announce mailing list
Security-announce-xEzmwC/hc7si8rCdYzckzA< at >public.gmane.org
http://lists.vmware.com/mailman/listinfo/security-announce
NEW : VMSA-2015-0009 : VMware product updates address a critical deserialization vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0009
Synopsis: VMware product updates address a critical deserialization
vulnerability
Issue date: 2015-12-18
Updated on: 2015-12-18 (Initial Advisory)
CVE number: CVE-2015-6934
- ------------------------------------------------------------------------
1. Summary
VMware product updates address a critical deserialization
vulnerability
2. Relevant Releases
vRealize Orchestrator 6.x
vCenter Orchestrator 5.x
3. Problem Description
a. Deserialization vulnerability
A deserialization vulnerability involving Apache Commons-collections
and a specially constructed chain of classes exists. Successful
exploitation could result in remote code execution, with the
permissions of the application using the Commons-collections library.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the identifier CVE-2015-6934 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
===================== ======= ======= =================
vRealize Orchestrator 7.0 Any Not Affected
vRealize Orchestrator 6.x Any See KB2141244
vCenter Orchestrator 5.x Any See KB2141244
vRealize Operations 6.x Windows Patch Pending *
vCenter Operations 5.x Windows Patch Pending *
vCenter Application 7.x Any Patch Pending
Discovery Manager (vADM)
* Exploitation of the issue on vRealize Operations
and vCenter Operations is limited to local privilege escalation.
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
vRealize Orchestrator 6.x and
vCenter Orchestrator 5.x
Downloads and Documentation:
http://kb.vmware.com/kb/2141244
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6934
- ------------------------------------------------------------------------
6. Change log
2015-12-18 VMSA-2015-0009 Initial security advisory in conjunction
with the release of vRealize Orchestrator 6.x and vCenter
Orchestrator 5.x patches on 2015-12-18.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 16127)
Charset: utf-8
wj8DBQFWdE+lDEcm8Vbi9kMRAof5AJ98+2YWBOBUdQqTs3iXLzgP2bG6sgCdExfu
ibmrI7HVp13hVX5fsMB5Qis=
=lzgH
-----END PGP SIGNATURE-----
UPDATE : VMSA-2015-0003.15 – VMware product updates address critical information disclosure issue in JRE.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0003.15
Synopsis: VMware product updates address critical information
disclosure issue in JRE.
Issue date: 2015-04-02
Updated on: 2015-12-18
CVE number: CVE-2014-6593, for other CVEs see JRE reference
- ------------------------------------------------------------------------
1. Summary
VMware product updates address critical information disclosure
issue in JRE.
2. Relevant Releases
Horizon View 6.x or 5.x
Horizon Workspace Portal Server 2.1 or 2.0
Horizon DaaS Platform 6.1.4 or 5.4.5
vCloud Networking and Security prior to 5.5.4.1
vCloud Connector 2.7
vCloud Usage Meter 3.3
vCenter Site Recovery Manager prior to 5.5.1.5, 5.1.3.1 or 5.0.3.3
vCenter Server 6.0, 5.5, 5.1 or 5.0
vRealize Operations Manager 6.0
vCenter Operations Manager 5.8.x or 5.7.x
vCenter Support Assistant 5.5.1.x
vRealize Application Services 6.2 or 6.1
vCloud Application Director 6.0
vRealize Automation 6.2 or 6.1
vCloud Automation Center 6.0.1
vSphere Replication prior to 5.8.0.2, 5.6.0.3, 5.5.1.5 or 5.1.3.1
vRealize Automation 6.2.x or 6.1.x
vRealize Code Stream 1.1 or 1.0
vFabric Postgres 9.3.6.0, 9.2.10.0 or 9.1.15.0
vRealize Hyperic 5.8.x, 5.7.x or 5.0.x
vSphere AppHA Prior to 1.1.x
vSphere Big Data Extensions 2.1 and 2.0
vSphere Data Protection 6.0 and 5.8
vCenter Chargeback Manager 2.7 or 2.6
vRealize Business Adv/Ent 8.1 or 8.0
vRealize Business Standard prior to 1.1.x or 1.0.x
NSX for vSphere 6.1
NSX for Multi-Hypervisor prior to 4.2.4
vCloud Director prior to 5.5.3
vCloud Director Service Providers prior to 5.6.4.1
vCenter Application Discovery Manager 7.0
vRealize Configuration Manager 5.7.x or 5.6.x
vRealize Infrastructure 5.8 or 5.7
vRealize Orchestrator 6.0, 5.5 or 5.1.3.1
vRealize Log Insight 2.5, 2.0, 1.5 or 1.0
vSphere Management Assistant 5.5 or 5.1
vSphere Update Manager 6.0, 5.5, 5.1 or 5.0
EVO:RAIL prior to 1.2.1
3. Problem Description
a. Oracle JRE Update
Oracle JRE is updated in VMware products to address a
critical security issue that existed in earlier releases of
Oracle JRE.
VMware products running JRE 1.7 Update 75 or newer and
JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593,
as documented in the Oracle Java SE Critical Patch Update
Advisory of January 2015.
This advisory also includes the other security issues that
are addressed in JRE 1.7 Update 75 and JRE 1.6 Update 91. The
References section provides a link to the JRE advisory.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2014-6593 to this issue. This
issue is also known as "SKIP" or "SKIP-TLS".
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch**
============= ======= ======= =================
Horizon View 6.x any 6.1
Horizon View 5.x any 5.3.4
Horizon Workspace Portal 2.1 ,2.0 any 2.1.1
Server
Horizon DaaS Platform 6.1 any 6.1.4
Horizon DaaS Platform 5.4 any 5.4.5
vCloud Networking and Security 5.5 any 5.5.4.1*
vCloud Connector 2.7 any 2.7.1*
vCloud Usage Meter 3.3 any 3.3.3*
vCenter Site Recovery Manager 5.5.x any 5.5.1.5***
vCenter Site Recovery Manager 5.1.x any 5.1.3.1***
vCenter Site Recovery Manager 5.0.x any 5.0.3.3***
vCenter Server 6.0 any 6.0.0a
vCenter Server 5.5 any Update 2e
vCenter Server 5.1 any Update 3a
vCenter Server 5.0 any Update 3d
vRealize Operations Manager 6.0 any KB2111898
vCenter Operations Manager 5.8.x any KB2111172
vCenter Operations Manager 5.7.x any KB2111172
vCenter Support Assistant 5.5.1.x any 6.0
vRealize Application Services 6.2 any KB2111981
vRealize Application Services 6.1 any KB2111981
vCloud Application Director 6.0 any KB2111981
vCloud Application Director 5.2 any KB2111981
vRealize Automation 6.2 any KB2111658
vRealize Automation 6.1 any KB2111658
vCloud Automation Center 6.0.1 any KB2111658
vRealize Code Stream 1.1 any KB2111658
vRealize Code Stream 1.0 any KB2111658
vPostgres 9.3.x any 9.3.6.0
vPostgres 9.2.x any 9.2.10.0
vPostgres 9.1.x any 9.1.15.0
vSphere Replication 5.8.0 any 5.8.0.2
vSphere Replication 5.6.0 any 5.6.0.3
vSphere Replication 5.5.0 any 5.5.1.5
vSphere Replication 5.1 any 5.1.3.1
vRealize Hyperic 5.8 any KB2111337
vRealize Hyperic 5.7 any KB2111337
vRealize Hyperic 5.0 any KB2111337
vSphere AppHA 1.1 any KB2111336
vSphere Big Data Extensions 2.1 any KB2116604*
vSphere Big Data Extensions 2.0 any KB2116604*
vSphere Data Protection 6.0 any 6.1*
vSphere Data Protection 5.8 any 5.8.3*
vSphere Data Protection 5.5 any no patch planned*
vSphere Data Protection 5.1 any no patch planned*
vCenter Chargeback Manager 2.7 any KB2112011*
vCenter Chargeback Manager 2.6 any KB2113178*
vRealize Business Adv/Ent 8.1 any KB2112258*
vRealize Business Adv/Ent 8.0 any KB2112258*
vRealize Business Standard 6.0 any KB2111802
vRealize Business Standard 1.1 any KB2111802
vRealize Business Standard 1.0 any KB2111802
NSX for vSphere 6.1 any 6.1.4*
NSX for Multi-Hypervisor 4.2 any 4.2.4*
vCloud Director 5.5.x any 5.5.3*
vCloud Director For 5.6.4 any 5.6.4.1*
Service Providers
vCenter Application Discovery 7.0 any 7.1*
Manager
vRealize Configuration Manager 5.7.x any KB2111670
vRealize Configuration Manager 5.6 any KB2111670
vRealize Infrastructure 5.8 any 5.8.4
Navigator
vRealize Infrastructure 5.7 any KB2111334*
Navigator
vRealize Orchestrator 6.0 any KB2112028*
vRealize Orchestrator 5.5 any KB2112028*
vRealize Orchestrator 5.1 any 5.1.3.1*
vRealize Log Insight 2.5 any KB2113235*
vRealize Log Insight 2.0 any KB2113235*
vRealize Log Insight 1.5 any KB2113235*
vRealize Log Insight 1.0 any KB2113235*
vSphere Management Assistant 5.5.x any 5.5.0.4
vSphere Management Assistant 5.1.x any 5.1.0.3
vSphere Update Manager 6.0 any 6.0.0a*
vSphere Update Manager 5.5 any Update 2e*
vSphere Update Manager 5.1 any Update 3a*
vSphere Update Manager 5.0 any Update 3d*
EVO:RAIL 1.2.0 any 1.2.1*
* The severity of critical is lowered to important for this product
as is not considered Internet facing
** Knowledge Base (KB) articles provides details of the patches and
how to install them.
*** vCenter Site Recovery Manager 5.0, 5.1, and 5.5 itself do not
include JRE but they include the vSphere Replication appliance
which has JRE. vCenter Site Recovery 5.8 and 6.0 do not include
JRE nor the vSphere Replication appliance.
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
Horizon View 6.1, 5.3.4:
========================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productI
d=492
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&pro
ductId=396
VMware Workspace Portal 2.1.1
=============================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HZNWS211&productId=5
01&rPId=7586
Documentation:
https://www.vmware.com/support/horizon_workspace/doc/wp_release_notes_211.h
tml
Horizon DaaS Platform 6.1.4
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-610-BIN
&productId=405&rPId=6527
Horizon DaaS Platform 5.4.5
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-ONPREM-
540&productId=398&rPId=5214
vCloud Networking and Security 5.5.4.1
======================================
Download:
https://my.vmware.com/web/vmware/details?productId=360&rPId=7625&downloadGr
oup=VCNS5541
Documentation:
https://www.vmware.com/support/vshield/doc/releasenotes_vshield_5541.html
vCloud Connector 2.7.1
======================
Downloads and Documentation:
http://www.vmware.com/support/hybridcloud/doc/hybridcloud_271_rel_notes.htm
l
vCloud Usage Meter 3.3.3
========================
Downloads:
https://my.vmware.com/en/group/vmware/get-download?downloadGroup=UMSV333
vCenter Application Discovery Manager 7.1
=========================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VADM-710-VA&productI
d=300&rPId=8646
Documentation:
https://www.vmware.com/support/adm/doc/vcenter-application-discovery-manage
r-71-release-notes.html
vCenter Site Recovery Manager 5.5.1.5, 5.1.3.1, 5.0.3.3
=======================================================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5515&productId=35
7&rPId=7774
https://my.vmware.com/group/vmware/details?downloadGroup=SRM5131&productId=
291&rPId=9236
https://my.vmware.com/group/vmware/details?downloadGroup=SRM5033&productId=
238&rPId=6626
Documentation:
https://www.vmware.com/support/srm/srm-releasenotes-5-5-1.html
https://www.vmware.com/support/srm/srm-releasenotes-5-1-3-1.html
https://www.vmware.com/support/srm/srm-releasenotes-5-0-3.html
vCenter Server 6.0, 5.5, 5.1, 5.0
=================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
vRealize Operations Manager 6.0.1
=================================
Downloads and Documentation: http://kb.vmware.com/kb/2111898
vCenter Support Assistant 6.0
=============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?downloadGroup=VCSA600&productId=49
1
vRealize Application Services 6.2, 6.1
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
NSX for vSphere 6.1.4
=====================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?productId=417&downloadGroup=NSX-V-
614
NSX for Multi-Hypervisor 4.2.4
==============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/info/slug/networking_security/vmware_nsx/4
_x
vCloud Application Director 6.0
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
vCloud Director for Service Providers 5.6.4.1
=============================================
Downloads and Documentation:
https://www.vmware.com/support/pubs/vcd_sp_pubs.html
vCenter Operations Manager 5.8.5, 5.7.4
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111172
vCloud Automation Center 6.0.1.2
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vSphere Replication 5.8.0.2, 5.6.0.3, 5.5.1.5, 5.1.3.1
=============================================
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5802
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5603
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5515
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5131
Documentation:
http://kb.vmware.com/kb/2112025
http://kb.vmware.com/kb/2112022
http://kb.vmware.com/kb/2112012
vRealize Automation 6.2.1, 6.1.1
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111658
vRealize Code Stream 1.1, 1.0
=============================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vFabric Postgres
================
Downloads
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_936&productId
=373&rPId=7787
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_92_10&product
Id=325&rPId=7788
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_91_15&product
Id=274&rPId=7789
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3
====================================
Downloads and Documentation: http://kb.vmware.com/kb/KB2111337
vSphere AppHA 1.1.1
===================
Downloads and Documentation: http://kb.vmware.com/kb/2111336
vSphere Big Data Extensions 2.1 and 2.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2116604
vSphere Data Protection 6.1
===========================
Downloads:
https://my.vmware.com/web/vmware/details?productId=491&downloadGroup=VDP61
Documentation:
http://pubs.vmware.com/Release_Notes/en/vdp/61/vdp_610_releasenotes.html
vSphere Data Protection 5.8.3
===========================
Downloads:
https://my.vmware.com/group/vmware/details?productId=353&rPId=8950&download
Group=VDP58_3
Documentation: https://www.vmware.com/support/pubs/vdr_pubs.html
vCenter Chargeback Manager 2.7
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112011
vCenter Chargeback Manager 2.6
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2113178
vRealize Business Adv/Ent 8.1, 8.0
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112258
vRealize Business Standard 6.0, 1.1 , 1.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111802
vRealize Configuration Manager 5.7.3
===================================
Downloads and Documentation: http://kb.vmware.com/kb/2111670
vRealize Infrastructure Navigator 5.8.4
=======================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VIN_584&productId=47
6
vRealize Infrastructure Navigator 5.7
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2111334
vRealize Orchestrator 6.0, 5.5
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112028
vRealize Orchestrator 5.1.3.1
=============================
Download:
https://my.vmware.com/group/vmware/get-download?downloadGroup=VSP51-VCL-VCO
VA-51U3A Documentation:
https://www.vmware.com/support/pubs/orchestrator_pubs.html
vSphere Management Assistant 5.5.0.4
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VMA550&productId=352
Documentation: http://kb.vmware.com/kb/2112648
vSphere Management Assistant 5.1.0.3
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP510-VMA-510&produ
ctId=285
Documentation: http://kb.vmware.com/kb/2112647
vSphere Update Manager 6.0, 5.5, 5.1, 5.0
=========================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
EVO:RAIL
========
Downloads and Documentation:
https://my.vmware.com/group/vmware/details?productId=442&downloadGroup=EVOR
AIL1_2_1
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593
JRE
Oracle Java SE Critical Patch Update Advisory of January 2015
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- ------------------------------------------------------------------------
6. Change log
2015-04-02 VMSA-2015-0003
Initial security advisory in conjunction with the release of VMware
Horizon View 6.1, 5.3.4; vCenter Operations Manager 5.8.5;
vCenter Operations Manager 5.7.4; vCloud Automation Center
6.0.1.2; vSphere Replication 5.8.0.2, 5.6.0.3; vRealize
Automation 6.2.1, 6.1.1; vRealize Code Stream 1.1, 1.0;
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3; vSphere AppHA 1.1.1;
vRealize Business Standard 1.1.1, 1.0.1; vRealize Configuration
Manager prior to 5.7.3; vRealize Infrastructure 5.7, 5.8.4 Patches
released on 2015-04-02.
2015-04-09 VMSA-2015-0003.1
Updated Security advisory in conjunction with the release of VMware
Horizon DaaS Platform 6.1.4, 5.4.5; vRealize Operations Manager 6.0;
vRealize Application Services 6.2; vRealize Application Services 6.1;
vCloud Application Director 6.0; vCenter Chargeback Manager 2.7, 2.6;
vCloud Director For Service Providers 5.6.4.1;
vRealize Log Insight 2.5, 2.0, 1.5, 1.0 Patches
released on 2015-04-09.
2015-04-13 VMSA-2015-0003.2
Updated Security advisory in conjunction with the release of
vRealize Business Adv/Ent 8.1, 8.0 Patches released
on 2015-04-13.
2015-04-16 VMSA-2015-0003.3
Updated Security advisory in conjunction with the release of
vCloud Connector 2.7.1; vCloud Usage Meter 3.3.3;
vCenter Server 6.0, 5.5; vSphere Update Manager 6.0, 5.5 patches
released on 2015-04-16.
2015-04-17 VMSA-2015-0003.4
Updated Security advisory in conjunction with the release of
vCenter Site Recovery Manager 5.5.1.5 patches released on 2015-04-16.
2015-04-23 VMSA-2015-0003.5
Updated Security advisory in conjunction with the release of
NSX for Multi-Hypervisor 4.2.4 and vFabric Postgres 9.3.6.0,
9.2.10.0 or 9.1.15.0 patches released on 2015-04-23.
2015-04-30 VMSA-2015-0003.6
Updated Security advisory in conjunction with the release of
vCloud Networking and Security 5.5.4.1, vCenter Server 5.1 Update 3a,
vCenter Server 5.0 Update 3d, vRealize Orchestrator 5.1.3.1,
vSphere Update Manager 5.1 Update 3a and
vSphere Update Manager 5.0 Update 3d patches released on 2015-04-30.
2015-05-07 VMSA-2015-0003.7
Updated Security advisory in conjunction with the release of
vCenter Support Assistant 6.0, vSphere Big Data Extensions 2.1
and 2.0, NSX for vSphere 6.1.4 patches released on 2015-05-07.
2015-05-08 VMSA-2015-0003.8
Updated Security advisory in conjunction with the release of
vSphere Management Assistant 5.5 and 5.1 patches released
on 2015-05-08.
2015-07-02 VMSA-2015-0003.9
Updated Security advisory in conjunction with the release of
EVO:Rail 1.2.1 patches released on 2015-07-02.
2015-08-14 VMSA-2015-0003.10
Updated Security advisory in conjunction with the release of
vCenter Application Discovery Manager 7.1.0 patches released
on 2015-08-13.
2015-09-10 VMSA-2015-0003.11
Updated Security advisory in conjunction with the release of
VMware vSphere Data Protection 6.1 released on 2015-09-10.
2015-10-15 VMSA-2015-0003.12
Updated Security advisory in conjunction with the release of
vSphere Replication 5.1.3.1 and vCenter Site Recovery Manager
5.1.3.1 released on 2015-10-15.
2015-10-20 VMSA-2015-0003.13
Updated Security advisory in conjunction with the release of
vSphere Data Protection 5.8.3 released on 2015-10-20.
2015-10-30 VMSA-2015-0003.14
Updated Security advisory in conjunction with the release of
vCenter Site Recovery Manager 5.0.3.3 released on 2015-10-29.
2015-12-18 VMSA-2015-0003.15
Updated Security advisory indicating vSphere Data Protection 5.5
and 5.1 have no patches planned.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 16127)
Charset: utf-8
wj8DBQFWdE7vDEcm8Vbi9kMRAo/GAKCZoq0eOkozQJ8oNnYZ9sK6UDyHXQCcDNgE
TNdJ8/K9yJyvDXlAXq1cYsk=
=F6RA
-----END PGP SIGNATURE-----
NEW VMSA-2015-0008 – VMware product updates address information disclosure issue
------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0008
Synopsis: VMware product updates address information disclosure
issue
Issue date: 2015-11-18
Updated on: 2015-11-18
CVE number: CVE-2015-3269
------------------------------------------------------------------------
1. Summary
VMware product updates address information disclosure issue.
2. Relevant Releases
VMware vCenter Server 5.5 prior to version 5.5 update 3
VMware vCenter Server 5.1 prior to version 5.1 update u3b
VMware vCenter Server 5.0 prior to version 5.0 update u3e
vCloud Director 5.6 prior to version 5.6.4
vCloud Director 5.5 prior to version 5.5.3
VMware Horizon View 6.0 prior to version 6.1
VMware Horizon View 5.0 prior to version 5.3.4
3. Problem Description
a. vCenter Server, vCloud Director, Horizon View information
disclosure issue.
VMware products that use Flex BlazeDS may be affected by a flaw in
the processing of XML External Entity (XXE) requests. A specially
crafted XML request sent to the server could lead to unintended
information be disclosed.
VMware would like to thank Matthias Kaiser of Code White GmbH for
reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-3269 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
==================== ======= =================
vCenter Server 6.0 any not affected
vCenter Server 5.5 any 5.5 update 3
vCenter Server 5.1 any 5.1 update u3b
vCenter Server 5.0 any 5.5 update u3e
vCloud Director 5.6 any 5.6.4
vCloud Director 5.5 any 5.5.3
Horizon View 6.0 any 6.1
Horizon View 5.3 any 5.3.4
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
vCenter Server
--------------------------------
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
vCloud Director For Service Providers
--------------------------------
Downloads and Documentation:
https://www.vmware.com/support/pubs/vcd_pubs.html
Horizon View 6.1, 5.3.4:
--------------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productId=492
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&productId=396
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3269
------------------------------------------------------------------------
6. Change log
2015-11-18 VMSA-2015-0008
Initial security advisory
------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
_______________________________________________
Security-announce mailing list
Security-announce-xEzmwC/hc7si8rCdYzckzA< at >public.gmane.org
http://lists.vmware.com/mailman/listinfo/security-announce
UPDATE : VMSA-2015-0003.14 – VMware product updates address critical information disclosure issue in JRE.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0003.14
Synopsis: VMware product updates address critical information
disclosure issue in JRE.
Issue date: 2015-04-02
Updated on: 2015-10-30
CVE number: CVE-2014-6593, for other CVEs see JRE reference
- ------------------------------------------------------------------------
1. Summary
VMware product updates address critical information disclosure
issue in JRE.
2. Relevant Releases
Horizon View 6.x or 5.x
Horizon Workspace Portal Server 2.1 or 2.0
Horizon DaaS Platform 6.1.4 or 5.4.5
vCloud Networking and Security prior to 5.5.4.1
vCloud Connector 2.7
vCloud Usage Meter 3.3
vCenter Site Recovery Manager prior to 5.5.1.5, 5.1.3.1 or 5.0.3.3
vCenter Server 6.0, 5.5, 5.1 or 5.0
vRealize Operations Manager 6.0
vCenter Operations Manager 5.8.x or 5.7.x
vCenter Support Assistant 5.5.1.x
vRealize Application Services 6.2 or 6.1
vCloud Application Director 6.0
vRealize Automation 6.2 or 6.1
vCloud Automation Center 6.0.1
vSphere Replication prior to 5.8.0.2, 5.6.0.3, 5.5.1.5 or 5.1.3.1
vRealize Automation 6.2.x or 6.1.x
vRealize Code Stream 1.1 or 1.0
vFabric Postgres 9.3.6.0, 9.2.10.0 or 9.1.15.0
vRealize Hyperic 5.8.x, 5.7.x or 5.0.x
vSphere AppHA Prior to 1.1.x
vSphere Big Data Extensions 2.1 and 2.0
vSphere Data Protection 6.0 and 5.8
vCenter Chargeback Manager 2.7 or 2.6
vRealize Business Adv/Ent 8.1 or 8.0
vRealize Business Standard prior to 1.1.x or 1.0.x
NSX for vSphere 6.1
NSX for Multi-Hypervisor prior to 4.2.4
vCloud Director prior to 5.5.3
vCloud Director Service Providers prior to 5.6.4.1
vCenter Application Discovery Manager 7.0
vRealize Configuration Manager 5.7.x or 5.6.x
vRealize Infrastructure 5.8 or 5.7
vRealize Orchestrator 6.0, 5.5 or 5.1.3.1
vRealize Log Insight 2.5, 2.0, 1.5 or 1.0
vSphere Management Assistant 5.5 or 5.1
vSphere Update Manager 6.0, 5.5, 5.1 or 5.0
EVO:RAIL prior to 1.2.1
3. Problem Description
a. Oracle JRE Update
Oracle JRE is updated in VMware products to address a
critical security issue that existed in earlier releases of
Oracle JRE.
VMware products running JRE 1.7 Update 75 or newer and
JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593,
as documented in the Oracle Java SE Critical Patch Update
Advisory of January 2015.
This advisory also includes the other security issues that
are addressed in JRE 1.7 Update 75 and JRE 1.6 Update 91. The
References section provides a link to the JRE advisory.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2014-6593 to this issue. This
issue is also known as "SKIP" or "SKIP-TLS".
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch**
============= ======= ======= =================
Horizon View 6.x any 6.1
Horizon View 5.x any 5.3.4
Horizon Workspace Portal 2.1 ,2.0 any 2.1.1
Server
Horizon DaaS Platform 6.1 any 6.1.4
Horizon DaaS Platform 5.4 any 5.4.5
vCloud Networking and Security 5.5 any 5.5.4.1*
vCloud Connector 2.7 any 2.7.1*
vCloud Usage Meter 3.3 any 3.3.3*
vCenter Site Recovery Manager 5.5.x any 5.5.1.5***
vCenter Site Recovery Manager 5.1.x any 5.1.3.1***
vCenter Site Recovery Manager 5.0.x any 5.0.3.3***
vCenter Server 6.0 any 6.0.0a
vCenter Server 5.5 any Update 2e
vCenter Server 5.1 any Update 3a
vCenter Server 5.0 any Update 3d
vRealize Operations Manager 6.0 any KB2111898
vCenter Operations Manager 5.8.x any KB2111172
vCenter Operations Manager 5.7.x any KB2111172
vCenter Support Assistant 5.5.1.x any 6.0
vRealize Application Services 6.2 any KB2111981
vRealize Application Services 6.1 any KB2111981
vCloud Application Director 6.0 any KB2111981
vCloud Application Director 5.2 any KB2111981
vRealize Automation 6.2 any KB2111658
vRealize Automation 6.1 any KB2111658
vCloud Automation Center 6.0.1 any KB2111658
vRealize Code Stream 1.1 any KB2111658
vRealize Code Stream 1.0 any KB2111658
vPostgres 9.3.x any 9.3.6.0
vPostgres 9.2.x any 9.2.10.0
vPostgres 9.1.x any 9.1.15.0
vSphere Replication 5.8.0 any 5.8.0.2
vSphere Replication 5.6.0 any 5.6.0.3
vSphere Replication 5.5.0 any 5.5.1.5
vSphere Replication 5.1 any 5.1.3.1
vRealize Hyperic 5.8 any KB2111337
vRealize Hyperic 5.7 any KB2111337
vRealize Hyperic 5.0 any KB2111337
vSphere AppHA 1.1 any KB2111336
vSphere Big Data Extensions 2.1 any KB2116604*
vSphere Big Data Extensions 2.0 any KB2116604*
vSphere Data Protection 6.0 any 6.1*
vSphere Data Protection 5.8 any 5.8.3*
vSphere Data Protection 5.5 any patch pending*
vSphere Data Protection 5.1 any patch pending*
vCenter Chargeback Manager 2.7 any KB2112011*
vCenter Chargeback Manager 2.6 any KB2113178*
vRealize Business Adv/Ent 8.1 any KB2112258*
vRealize Business Adv/Ent 8.0 any KB2112258*
vRealize Business Standard 6.0 any KB2111802
vRealize Business Standard 1.1 any KB2111802
vRealize Business Standard 1.0 any KB2111802
NSX for vSphere 6.1 any 6.1.4*
NSX for Multi-Hypervisor 4.2 any 4.2.4*
vCloud Director 5.5.x any 5.5.3*
vCloud Director For 5.6.4 any 5.6.4.1*
Service Providers
vCenter Application Discovery 7.0 any 7.1*
Manager
vRealize Configuration Manager 5.7.x any KB2111670
vRealize Configuration Manager 5.6 any KB2111670
vRealize Infrastructure 5.8 any 5.8.4
Navigator
vRealize Infrastructure 5.7 any KB2111334*
Navigator
vRealize Orchestrator 6.0 any KB2112028*
vRealize Orchestrator 5.5 any KB2112028*
vRealize Orchestrator 5.1 any 5.1.3.1*
vRealize Log Insight 2.5 any KB2113235*
vRealize Log Insight 2.0 any KB2113235*
vRealize Log Insight 1.5 any KB2113235*
vRealize Log Insight 1.0 any KB2113235*
vSphere Management Assistant 5.5.x any 5.5.0.4
vSphere Management Assistant 5.1.x any 5.1.0.3
vSphere Update Manager 6.0 any 6.0.0a*
vSphere Update Manager 5.5 any Update 2e*
vSphere Update Manager 5.1 any Update 3a*
vSphere Update Manager 5.0 any Update 3d*
EVO:RAIL 1.2.0 any 1.2.1*
* The severity of critical is lowered to important for this product
as is not considered Internet facing
** Knowledge Base (KB) articles provides details of the patches and
how to install them.
*** vCenter Site Recovery Manager 5.0, 5.1, and 5.5 itself do not
include JRE but they include the vSphere Replication appliance
which has JRE. vCenter Site Recovery 5.8 and 6.0 do not include
JRE nor the vSphere Replication appliance.
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
Horizon View 6.1, 5.3.4:
========================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productI
d=492
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&pro
ductId=396
VMware Workspace Portal 2.1.1
=============================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HZNWS211&productId=5
01&rPId=7586
Documentation:
https://www.vmware.com/support/horizon_workspace/doc/wp_release_notes_211.h
tml
Horizon DaaS Platform 6.1.4
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-610-BIN
&productId=405&rPId=6527
Horizon DaaS Platform 5.4.5
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-ONPREM-
540&productId=398&rPId=5214
vCloud Networking and Security 5.5.4.1
======================================
Download:
https://my.vmware.com/web/vmware/details?productId=360&rPId=7625&downloadGr
oup=VCNS5541
Documentation:
https://www.vmware.com/support/vshield/doc/releasenotes_vshield_5541.html
vCloud Connector 2.7.1
======================
Downloads and Documentation:
http://www.vmware.com/support/hybridcloud/doc/hybridcloud_271_rel_notes.htm
l
vCloud Usage Meter 3.3.3
========================
Downloads:
https://my.vmware.com/en/group/vmware/get-download?downloadGroup=UMSV333
vCenter Application Discovery Manager 7.1
=========================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VADM-710-VA&productI
d=300&rPId=8646
Documentation:
https://www.vmware.com/support/adm/doc/vcenter-application-discovery-manage
r-71-release-notes.html
vCenter Site Recovery Manager 5.5.1.5, 5.1.3.1, 5.0.3.3
=======================================================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5515&productId=35
7&rPId=7774
https://my.vmware.com/group/vmware/details?downloadGroup=SRM5131&productId=
291&rPId=9236
https://my.vmware.com/group/vmware/details?downloadGroup=SRM5033&productId=
238&rPId=6626
Documentation:
https://www.vmware.com/support/srm/srm-releasenotes-5-5-1.html
https://www.vmware.com/support/srm/srm-releasenotes-5-1-3-1.html
https://www.vmware.com/support/srm/srm-releasenotes-5-0-3.html
vCenter Server 6.0, 5.5, 5.1, 5.0
=================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
vRealize Operations Manager 6.0.1
=================================
Downloads and Documentation: http://kb.vmware.com/kb/2111898
vCenter Support Assistant 6.0
=============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?downloadGroup=VCSA600&productId=49
1
vRealize Application Services 6.2, 6.1
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
NSX for vSphere 6.1.4
=====================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?productId=417&downloadGroup=NSX-V-
614
NSX for Multi-Hypervisor 4.2.4
==============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/info/slug/networking_security/vmware_nsx/4
_x
vCloud Application Director 6.0
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
vCloud Director for Service Providers 5.6.4.1
=============================================
Downloads and Documentation:
https://www.vmware.com/support/pubs/vcd_sp_pubs.html
vCenter Operations Manager 5.8.5, 5.7.4
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111172
vCloud Automation Center 6.0.1.2
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vSphere Replication 5.8.0.2, 5.6.0.3, 5.5.1.5, 5.1.3.1
=============================================
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5802
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5603
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5515
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5131
Documentation:
http://kb.vmware.com/kb/2112025
http://kb.vmware.com/kb/2112022
http://kb.vmware.com/kb/2112012
vRealize Automation 6.2.1, 6.1.1
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111658
vRealize Code Stream 1.1, 1.0
=============================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vFabric Postgres
================
Downloads
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_936&productId
=373&rPId=7787
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_92_10&product
Id=325&rPId=7788
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_91_15&product
Id=274&rPId=7789
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3
====================================
Downloads and Documentation: http://kb.vmware.com/kb/KB2111337
vSphere AppHA 1.1.1
===================
Downloads and Documentation: http://kb.vmware.com/kb/2111336
vSphere Big Data Extensions 2.1 and 2.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2116604
vSphere Data Protection 6.1
===========================
Downloads:
https://my.vmware.com/web/vmware/details?productId=491&downloadGroup=VDP61
Documentation:
http://pubs.vmware.com/Release_Notes/en/vdp/61/vdp_610_releasenotes.html
vSphere Data Protection 5.8.3
===========================
Downloads:
https://my.vmware.com/group/vmware/details?productId=353&rPId=8950&download
Group=VDP58_3
Documentation: https://www.vmware.com/support/pubs/vdr_pubs.html
vCenter Chargeback Manager 2.7
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112011
vCenter Chargeback Manager 2.6
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2113178
vRealize Business Adv/Ent 8.1, 8.0
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112258
vRealize Business Standard 6.0, 1.1 , 1.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111802
vRealize Configuration Manager 5.7.3
===================================
Downloads and Documentation: http://kb.vmware.com/kb/2111670
vRealize Infrastructure Navigator 5.8.4
=======================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VIN_584&productId=47
6
vRealize Infrastructure Navigator 5.7
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2111334
vRealize Orchestrator 6.0, 5.5
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112028
vRealize Orchestrator 5.1.3.1
=============================
Download:
https://my.vmware.com/group/vmware/get-download?downloadGroup=VSP51-VCL-VCO
VA-51U3A
Documentation:
https://www.vmware.com/support/pubs/orchestrator_pubs.html
vSphere Management Assistant 5.5.0.4
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VMA550&productId=352
Documentation: http://kb.vmware.com/kb/2112648
vSphere Management Assistant 5.1.0.3
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP510-VMA-510&produ
ctId=285
Documentation: http://kb.vmware.com/kb/2112647
vSphere Update Manager 6.0, 5.5, 5.1, 5.0
=========================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
EVO:RAIL
========
Downloads and Documentation:
https://my.vmware.com/group/vmware/details?productId=442&downloadGroup=EVOR
AIL1_2_1
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593
JRE
Oracle Java SE Critical Patch Update Advisory of January 2015
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- ------------------------------------------------------------------------
6. Change log
2015-04-02 VMSA-2015-0003
Initial security advisory in conjunction with the release of VMware
Horizon View 6.1, 5.3.4; vCenter Operations Manager 5.8.5;
vCenter Operations Manager 5.7.4; vCloud Automation Center
6.0.1.2; vSphere Replication 5.8.0.2, 5.6.0.3; vRealize
Automation 6.2.1, 6.1.1; vRealize Code Stream 1.1, 1.0;
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3; vSphere AppHA 1.1.1;
vRealize Business Standard 1.1.1, 1.0.1; vRealize Configuration
Manager prior to 5.7.3; vRealize Infrastructure 5.7, 5.8.4 Patches
released on 2015-04-02.
2015-04-09 VMSA-2015-0003.1
Updated Security advisory in conjunction with the release of VMware
Horizon DaaS Platform 6.1.4, 5.4.5; vRealize Operations Manager 6.0;
vRealize Application Services 6.2; vRealize Application Services 6.1;
vCloud Application Director 6.0; vCenter Chargeback Manager 2.7, 2.6;
vCloud Director For Service Providers 5.6.4.1;
vRealize Log Insight 2.5, 2.0, 1.5, 1.0 Patches
released on 2015-04-09.
2015-04-13 VMSA-2015-0003.2
Updated Security advisory in conjunction with the release of
vRealize Business Adv/Ent 8.1, 8.0 Patches released
on 2015-04-13.
2015-04-16 VMSA-2015-0003.3
Updated Security advisory in conjunction with the release of
vCloud Connector 2.7.1; vCloud Usage Meter 3.3.3;
vCenter Server 6.0, 5.5; vSphere Update Manager 6.0, 5.5 patches
released on 2015-04-16.
2015-04-17 VMSA-2015-0003.4
Updated Security advisory in conjunction with the release of
vCenter Site Recovery Manager 5.5.1.5 patches released on 2015-04-16.
2015-04-23 VMSA-2015-0003.5
Updated Security advisory in conjunction with the release of
NSX for Multi-Hypervisor 4.2.4 and vFabric Postgres 9.3.6.0,
9.2.10.0 or 9.1.15.0 patches released on 2015-04-23.
2015-04-30 VMSA-2015-0003.6
Updated Security advisory in conjunction with the release of
vCloud Networking and Security 5.5.4.1, vCenter Server 5.1 Update 3a,
vCenter Server 5.0 Update 3d, vRealize Orchestrator 5.1.3.1,
vSphere Update Manager 5.1 Update 3a and
vSphere Update Manager 5.0 Update 3d patches released on 2015-04-30.
2015-05-07 VMSA-2015-0003.7
Updated Security advisory in conjunction with the release of
vCenter Support Assistant 6.0, vSphere Big Data Extensions 2.1
and 2.0, NSX for vSphere 6.1.4 patches released on 2015-05-07.
2015-05-08 VMSA-2015-0003.8
Updated Security advisory in conjunction with the release of
vSphere Management Assistant 5.5 and 5.1 patches released
on 2015-05-08.
2015-07-02 VMSA-2015-0003.9
Updated Security advisory in conjunction with the release of
EVO:Rail 1.2.1 patches released on 2015-07-02.
2015-08-14 VMSA-2015-0003.10
Updated Security advisory in conjunction with the release of
vCenter Application Discovery Manager 7.1.0 patches released
on 2015-08-13.
2015-09-10 VMSA-2015-0003.11
Updated Security advisory in conjunction with the release of
VMware vSphere Data Protection 6.1 released on 2015-09-10.
2015-10-15 VMSA-2015-0003.12
Updated Security advisory in conjunction with the release of
vSphere Replication 5.1.3.1 and vCenter Site Recovery Manager
5.1.3.1 released on 2015-10-15.
2015-10-20 VMSA-2015-0003.13
Updated Security advisory in conjunction with the release of
vSphere Data Protection 5.8.3 released on 2015-10-20.
2015-10-30 VMSA-2015-0003.14
Updated Security advisory in conjunction with the release of
vCenter Site Recovery Manager 5.0.3.3 released on 2015-10-29.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 16127)
Charset: utf-8
wj8DBQFWM58uDEcm8Vbi9kMRAp/aAJ9e71E4wuKNpLUF9VKSPIJJRj5bMwCglPRT
6MbE/7IATSPVDh/NK01z08M=
=XW8E
-----END PGP SIGNATURE-----
UPDATE : VMSA-2015-0007.2 VMware vCenter and ESXi updates address critical security issues
------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0007.2
Synopsis: VMware vCenter and ESXi updates address critical security
issues
Issue date: 2015-10-01
Updated on: 2015-10-20
CVE number: CVE-2015-5177 CVE-2015-2342 CVE-2015-1047
------------------------------------------------------------------------
1. Summary
VMware vCenter and ESXi updates address critical security issues.
2. Relevant Releases
VMware ESXi 5.5 without patch ESXi550-201509101-SG
VMware ESXi 5.1 without patch ESXi510-201510101-SG
VMware ESXi 5.0 without patch ESXi500-201510101-SG
VMware vCenter Server 6.0 prior to version 6.0.0b
VMware vCenter Server 5.5 prior to version 5.5 update 3
VMware vCenter Server 5.1 prior to version 5.1 update u3b
VMware vCenter Server 5.0 prior to version 5.0 update u3e
3. Problem Description
a. VMWare ESXi OpenSLP Remote Code Execution
VMware ESXi contains a double free flaw in OpenSLP's
SLPDProcessMessage() function. Exploitation of this issue may
allow an unauthenticated attacker to remotely execute code on
the ESXi host.
VMware would like to thank Qinghao Tang of QIHU 360 for reporting
this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-5177 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
==================== ======= =================
ESXi 6.0 ESXi not affected
ESXi 5.5 ESXi ESXi550-201509101-SG *
ESXi 5.1 ESXi ESXi510-201510101-SG
ESXi 5.0 ESXi ESXi500-201510101-SG
* Customers who have installed the complete set of ESXi 5.5 U3
Bulletins, please review VMware KB 2133118. KB 2133118 documents
a known non-security issue and provides a solution.
b. VMware vCenter Server JMX RMI Remote Code Execution
VMware vCenter Server contains a remotely accessible JMX RMI
service that is not securely configured. An unauthenticated remote
attacker who is able to connect to the service may be able to use
it to execute arbitrary code on the vCenter server.
vCenter Server Appliance (vCSA) 5.1, 5.5 and 6.0 has remote access
to the JMX RMI service (port 9875) blocked by default.
VMware would like to thank Doug McLeod of 7 Elements Ltd and an
anonymous researcher working through HP's Zero Day Initiative for
reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-2342 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= ===============
VMware vCenter Server 6.0 Any 6.0.0b
VMware vCenter Server 5.5 Any 5.5 u3
VMware vCenter Server 5.1 Any 5.1 u3b
VMware vCenter Server 5.0 Any 5.0 u3e
c. VMware vCenter Server vpxd denial-of-service vulnerability
VMware vCenter Server does not properly sanitize long heartbeat
messages. Exploitation of this issue may allow an unauthenticated
attacker to create a denial-of-service condition in the vpxd
service.
VMware would like to thank the Google Security Team for reporting
this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-1047 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= ==============
VMware vCenter Server 6.0 Any not affected
VMware vCenter Server 5.5 Any 5.5u2
VMware vCenter Server 5.1 Any 5.1u3
VMware vCenter Server 5.0 Any 5.0u3e
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
ESXi
--------------------------------
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2110247
http://kb.vmware.com/kb/2114875
http://kb.vmware.com/kb/2120209
vCenter Server
--------------------------------
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5177
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2342
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1047
http://kb.vmware.com/kb/2133118
------------------------------------------------------------------------
6. Change log
2015-10-20 VMSA-2015-0007.2
Updated security advisory to reflect that CVE-2015-2342 is fixed in
an earlier vCenter Server version (6.0.0b) than originally reported
(6.0 U1) and that the port required to exploit the vulnerability is
blocked in the appliance versions of the software (5.1 and above).
2015-10-06 VMSA-2015-0007.1
Updated security advisory in conjunction with the release of ESXi 5.5
U3a on 2015-10-06. Added a note to section 3.a to alert customers to
a non-security issue in ESXi 5.5 U3 that is addressed in ESXi 5.5 U3a.
2015-10-01 VMSA-2015-0007
Initial security advisory in conjunction with ESXi 5.0, 5.1 patches
and VMware vCenter Server 5.1 u3b, 5.0 u3e on 2015-10-01.
------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
_______________________________________________
Security-announce mailing list
Security-announce-xEzmwC/hc7si8rCdYzckzA< at >public.gmane.org
http://lists.vmware.com/mailman/listinfo/security-announce
UPDATE : VMSA-2015-0003.13 – VMware product updates address critical information disclosure issue in JRE.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0003.13
Synopsis: VMware product updates address critical information
disclosure issue in JRE.
Issue date: 2015-04-02
Updated on: 2015-10-20
CVE number: CVE-2014-6593, for other CVEs see JRE reference
- ------------------------------------------------------------------------
1. Summary
VMware product updates address critical information disclosure
issue in JRE.
2. Relevant Releases
Horizon View 6.x or 5.x
Horizon Workspace Portal Server 2.1 or 2.0
Horizon DaaS Platform 6.1.4 or 5.4.5
vCloud Networking and Security prior to 5.5.4.1
vCloud Connector 2.7
vCloud Usage Meter 3.3
vCenter Site Recovery Manager prior to 5.5.1.5 or 5.1.3.1
vCenter Server 6.0, 5.5, 5.1 or 5.0
vRealize Operations Manager 6.0
vCenter Operations Manager 5.8.x or 5.7.x
vCenter Support Assistant 5.5.1.x
vRealize Application Services 6.2 or 6.1
vCloud Application Director 6.0
vRealize Automation 6.2 or 6.1
vCloud Automation Center 6.0.1
vSphere Replication prior to 5.8.0.2, 5.6.0.3, 5.5.1.5 or 5.1.3.1
vRealize Automation 6.2.x or 6.1.x
vRealize Code Stream 1.1 or 1.0
vFabric Postgres 9.3.6.0, 9.2.10.0 or 9.1.15.0
vRealize Hyperic 5.8.x, 5.7.x or 5.0.x
vSphere AppHA Prior to 1.1.x
vSphere Big Data Extensions 2.1 and 2.0
vSphere Data Protection 6.0 and 5.8
vCenter Chargeback Manager 2.7 or 2.6
vRealize Business Adv/Ent 8.1 or 8.0
vRealize Business Standard prior to 1.1.x or 1.0.x
NSX for vSphere 6.1
NSX for Multi-Hypervisor prior to 4.2.4
vCloud Director prior to 5.5.3
vCloud Director Service Providers prior to 5.6.4.1
vCenter Application Discovery Manager 7.0
vRealize Configuration Manager 5.7.x or 5.6.x
vRealize Infrastructure 5.8 or 5.7
vRealize Orchestrator 6.0, 5.5 or 5.1.3.1
vRealize Log Insight 2.5, 2.0, 1.5 or 1.0
vSphere Management Assistant 5.5 or 5.1
vSphere Update Manager 6.0, 5.5, 5.1 or 5.0
EVO:RAIL prior to 1.2.1
3. Problem Description
a. Oracle JRE Update
Oracle JRE is updated in VMware products to address a
critical security issue that existed in earlier releases of
Oracle JRE.
VMware products running JRE 1.7 Update 75 or newer and
JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593,
as documented in the Oracle Java SE Critical Patch Update
Advisory of January 2015.
This advisory also includes the other security issues that
are addressed in JRE 1.7 Update 75 and JRE 1.6 Update 91. The
References section provides a link to the JRE advisory.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2014-6593 to this issue. This
issue is also known as "SKIP" or "SKIP-TLS".
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch**
============= ======= ======= =================
Horizon View 6.x any 6.1
Horizon View 5.x any 5.3.4
Horizon Workspace Portal 2.1 ,2.0 any 2.1.1
Server
Horizon DaaS Platform 6.1 any 6.1.4
Horizon DaaS Platform 5.4 any 5.4.5
vCloud Networking and Security 5.5 any 5.5.4.1*
vCloud Connector 2.7 any 2.7.1*
vCloud Usage Meter 3.3 any 3.3.3*
vCenter Site Recovery Manager 5.5.x any 5.5.1.5***
vCenter Site Recovery Manager 5.1.x any 5.1.3.1***
vCenter Site Recovery Manager 5.0.x any patch pending***
vCenter Server 6.0 any 6.0.0a
vCenter Server 5.5 any Update 2e
vCenter Server 5.1 any Update 3a
vCenter Server 5.0 any Update 3d
vRealize Operations Manager 6.0 any KB2111898
vCenter Operations Manager 5.8.x any KB2111172
vCenter Operations Manager 5.7.x any KB2111172
vCenter Support Assistant 5.5.1.x any 6.0
vRealize Application Services 6.2 any KB2111981
vRealize Application Services 6.1 any KB2111981
vCloud Application Director 6.0 any KB2111981
vCloud Application Director 5.2 any KB2111981
vRealize Automation 6.2 any KB2111658
vRealize Automation 6.1 any KB2111658
vCloud Automation Center 6.0.1 any KB2111658
vRealize Code Stream 1.1 any KB2111658
vRealize Code Stream 1.0 any KB2111658
vPostgres 9.3.x any 9.3.6.0
vPostgres 9.2.x any 9.2.10.0
vPostgres 9.1.x any 9.1.15.0
vSphere Replication 5.8.0 any 5.8.0.2
vSphere Replication 5.6.0 any 5.6.0.3
vSphere Replication 5.5.0 any 5.5.1.5
vSphere Replication 5.1 any 5.1.3.1
vRealize Hyperic 5.8 any KB2111337
vRealize Hyperic 5.7 any KB2111337
vRealize Hyperic 5.0 any KB2111337
vSphere AppHA 1.1 any KB2111336
vSphere Big Data Extensions 2.1 any KB2116604*
vSphere Big Data Extensions 2.0 any KB2116604*
vSphere Data Protection 6.0 any 6.1*
vSphere Data Protection 5.8 any 5.8.3*
vSphere Data Protection 5.5 any patch pending*
vSphere Data Protection 5.1 any patch pending*
vCenter Chargeback Manager 2.7 any KB2112011*
vCenter Chargeback Manager 2.6 any KB2113178*
vRealize Business Adv/Ent 8.1 any KB2112258*
vRealize Business Adv/Ent 8.0 any KB2112258*
vRealize Business Standard 6.0 any KB2111802
vRealize Business Standard 1.1 any KB2111802
vRealize Business Standard 1.0 any KB2111802
NSX for vSphere 6.1 any 6.1.4*
NSX for Multi-Hypervisor 4.2 any 4.2.4*
vCloud Director 5.5.x any 5.5.3*
vCloud Director For 5.6.4 any 5.6.4.1*
Service Providers
vCenter Application Discovery 7.0 any 7.1*
Manager
vRealize Configuration Manager 5.7.x any KB2111670
vRealize Configuration Manager 5.6 any KB2111670
vRealize Infrastructure 5.8 any 5.8.4
Navigator
vRealize Infrastructure 5.7 any KB2111334*
Navigator
vRealize Orchestrator 6.0 any KB2112028*
vRealize Orchestrator 5.5 any KB2112028*
vRealize Orchestrator 5.1 any 5.1.3.1*
vRealize Log Insight 2.5 any KB2113235*
vRealize Log Insight 2.0 any KB2113235*
vRealize Log Insight 1.5 any KB2113235*
vRealize Log Insight 1.0 any KB2113235*
vSphere Management Assistant 5.5.x any 5.5.0.4
vSphere Management Assistant 5.1.x any 5.1.0.3
vSphere Update Manager 6.0 any 6.0.0a*
vSphere Update Manager 5.5 any Update 2e*
vSphere Update Manager 5.1 any Update 3a*
vSphere Update Manager 5.0 any Update 3d*
EVO:RAIL 1.2.0 any 1.2.1*
* The severity of critical is lowered to important for this product
as is not considered Internet facing
** Knowledge Base (KB) articles provides details of the patches and
how to install them.
*** vCenter Site Recovery Manager 5.0, 5.1, and 5.5 itself do not
include JRE but they include the vSphere Replication appliance
which has JRE. vCenter Site Recovery 5.8 and 6.0 do not include
JRE nor the vSphere Replication appliance.
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
Horizon View 6.1, 5.3.4:
========================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productI
d=492
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&pro
ductId=396
VMware Workspace Portal 2.1.1
=============================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HZNWS211&productId=5
01&rPId=7586
Documentation:
https://www.vmware.com/support/horizon_workspace/doc/wp_release_notes_211.h
tml
Horizon DaaS Platform 6.1.4
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-610-BIN
&productId=405&rPId=6527
Horizon DaaS Platform 5.4.5
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-ONPREM-
540&productId=398&rPId=5214
vCloud Networking and Security 5.5.4.1
======================================
Download:
https://my.vmware.com/web/vmware/details?productId=360&rPId=7625&downloadGr
oup=VCNS5541
Documentation:
https://www.vmware.com/support/vshield/doc/releasenotes_vshield_5541.html
vCloud Connector 2.7.1
======================
Downloads and Documentation:
http://www.vmware.com/support/hybridcloud/doc/hybridcloud_271_rel_notes.htm
l
vCloud Usage Meter 3.3.3
========================
Downloads:
https://my.vmware.com/en/group/vmware/get-download?downloadGroup=UMSV333
vCenter Application Discovery Manager 7.1
=========================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VADM-710-VA&productI
d=300&rPId=8646
Documentation:
https://www.vmware.com/support/adm/doc/vcenter-application-discovery-manage
r-71-release-notes.html
vCenter Site Recovery Manager 5.5.1.5
======================================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5515&productId=35
7&rPId=7774
https://my.vmware.com/group/vmware/details?downloadGroup=SRM5131&productId=
291&rPId=9236
Documentation:
https://www.vmware.com/support/srm/srm-releasenotes-5-5-1.html
https://www.vmware.com/support/srm/srm-releasenotes-5-1-3-1.html
vCenter Server 6.0, 5.5, 5.1, 5.0
=================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
vRealize Operations Manager 6.0.1
=================================
Downloads and Documentation: http://kb.vmware.com/kb/2111898
vCenter Support Assistant 6.0
=============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?downloadGroup=VCSA600&productId=49
1
vRealize Application Services 6.2, 6.1
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
NSX for vSphere 6.1.4
=====================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?productId=417&downloadGroup=NSX-V-
614
NSX for Multi-Hypervisor 4.2.4
==============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/info/slug/networking_security/vmware_nsx/4
_x
vCloud Application Director 6.0
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
vCloud Director for Service Providers 5.6.4.1
=============================================
Downloads and Documentation:
https://www.vmware.com/support/pubs/vcd_sp_pubs.html
vCenter Operations Manager 5.8.5, 5.7.4
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111172
vCloud Automation Center 6.0.1.2
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vSphere Replication 5.8.0.2, 5.6.0.3, 5.5.1.5, 5.1.3.1
=============================================
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5802
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5603
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5515
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5131
Documentation:
http://kb.vmware.com/kb/2112025
http://kb.vmware.com/kb/2112022
http://kb.vmware.com/kb/2112012
vRealize Automation 6.2.1, 6.1.1
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111658
vRealize Code Stream 1.1, 1.0
=============================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vFabric Postgres
================
Downloads
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_936&productId
=373&rPId=7787
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_92_10&product
Id=325&rPId=7788
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_91_15&product
Id=274&rPId=7789
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3
====================================
Downloads and Documentation: http://kb.vmware.com/kb/KB2111337
vSphere AppHA 1.1.1
===================
Downloads and Documentation: http://kb.vmware.com/kb/2111336
vSphere Big Data Extensions 2.1 and 2.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2116604
vSphere Data Protection 6.1
===========================
Downloads:
https://my.vmware.com/web/vmware/details?productId=491&downloadGroup=VDP61
Documentation:
http://pubs.vmware.com/Release_Notes/en/vdp/61/vdp_610_releasenotes.html
vSphere Data Protection 5.8.3
===========================
Downloads:
https://my.vmware.com/group/vmware/details?productId=353&rPId=8950&download
Group=VDP58_3
Documentation: https://www.vmware.com/support/pubs/vdr_pubs.html
vCenter Chargeback Manager 2.7
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112011
vCenter Chargeback Manager 2.6
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2113178
vRealize Business Adv/Ent 8.1, 8.0
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112258
vRealize Business Standard 6.0, 1.1 , 1.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111802
vRealize Configuration Manager 5.7.3
===================================
Downloads and Documentation: http://kb.vmware.com/kb/2111670
vRealize Infrastructure Navigator 5.8.4
=======================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VIN_584&productId=47
6
vRealize Infrastructure Navigator 5.7
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2111334
vRealize Orchestrator 6.0, 5.5
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112028
vRealize Orchestrator 5.1.3.1
=============================
Download:
https://my.vmware.com/group/vmware/get-download?downloadGroup=VSP51-VCL-VCO
VA-51U3A
Documentation:
https://www.vmware.com/support/pubs/orchestrator_pubs.html
vSphere Management Assistant 5.5.0.4
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VMA550&productId=352
Documentation: http://kb.vmware.com/kb/2112648
vSphere Management Assistant 5.1.0.3
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP510-VMA-510&produ
ctId=285
Documentation: http://kb.vmware.com/kb/2112647
vSphere Update Manager 6.0, 5.5, 5.1, 5.0
=========================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
EVO:RAIL
========
Downloads and Documentation:
https://my.vmware.com/group/vmware/details?productId=442&downloadGroup=EVOR
AIL1_2_1
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593
JRE
Oracle Java SE Critical Patch Update Advisory of January 2015
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- ------------------------------------------------------------------------
6. Change log
2015-04-02 VMSA-2015-0003
Initial security advisory in conjunction with the release of VMware
Horizon View 6.1, 5.3.4; vCenter Operations Manager 5.8.5;
vCenter Operations Manager 5.7.4; vCloud Automation Center
6.0.1.2; vSphere Replication 5.8.0.2, 5.6.0.3; vRealize
Automation 6.2.1, 6.1.1; vRealize Code Stream 1.1, 1.0;
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3; vSphere AppHA 1.1.1;
vRealize Business Standard 1.1.1, 1.0.1; vRealize Configuration
Manager prior to 5.7.3; vRealize Infrastructure 5.7, 5.8.4 Patches
released on 2015-04-02.
2015-04-09 VMSA-2015-0003.1
Updated Security advisory in conjunction with the release of VMware
Horizon DaaS Platform 6.1.4, 5.4.5; vRealize Operations Manager 6.0;
vRealize Application Services 6.2; vRealize Application Services 6.1;
vCloud Application Director 6.0; vCenter Chargeback Manager 2.7, 2.6;
vCloud Director For Service Providers 5.6.4.1;
vRealize Log Insight 2.5, 2.0, 1.5, 1.0 Patches
released on 2015-04-09.
2015-04-13 VMSA-2015-0003.2
Updated Security advisory in conjunction with the release of
vRealize Business Adv/Ent 8.1, 8.0 Patches released
on 2015-04-13.
2015-04-16 VMSA-2015-0003.3
Updated Security advisory in conjunction with the release of
vCloud Connector 2.7.1; vCloud Usage Meter 3.3.3;
vCenter Server 6.0, 5.5; vSphere Update Manager 6.0, 5.5 patches
released on 2015-04-16.
2015-04-17 VMSA-2015-0003.4
Updated Security advisory in conjunction with the release of
vCenter Site Recovery Manager 5.5.1.5 patches released on 2015-04-16.
2015-04-23 VMSA-2015-0003.5
Updated Security advisory in conjunction with the release of
NSX for Multi-Hypervisor 4.2.4 and vFabric Postgres 9.3.6.0,
9.2.10.0 or 9.1.15.0 patches released on 2015-04-23.
2015-04-30 VMSA-2015-0003.6
Updated Security advisory in conjunction with the release of
vCloud Networking and Security 5.5.4.1, vCenter Server 5.1 Update 3a,
vCenter Server 5.0 Update 3d, vRealize Orchestrator 5.1.3.1,
vSphere Update Manager 5.1 Update 3a and
vSphere Update Manager 5.0 Update 3d patches released on 2015-04-30.
2015-05-07 VMSA-2015-0003.7
Updated Security advisory in conjunction with the release of
vCenter Support Assistant 6.0, vSphere Big Data Extensions 2.1
and 2.0, NSX for vSphere 6.1.4 patches released on 2015-05-07.
2015-05-08 VMSA-2015-0003.8
Updated Security advisory in conjunction with the release of
vSphere Management Assistant 5.5 and 5.1 patches released
on 2015-05-08.
2015-07-02 VMSA-2015-0003.9
Updated Security advisory in conjunction with the release of
EVO:Rail 1.2.1 patches released on 2015-07-02.
2015-08-14 VMSA-2015-0003.10
Updated Security advisory in conjunction with the release of
vCenter Application Discovery Manager 7.1.0 patches released
on 2015-08-13.
2015-09-10 VMSA-2015-0003.11
Updated Security advisory in conjunction with the release of
VMware vSphere Data Protection 6.1 released on 2015-09-10.
2015-10-15 VMSA-2015-0003.12
Updated Security advisory in conjunction with the release of
vSphere Replication 5.1.3.1 and vCenter Site Recovery Manager
5.1.3.1 released on 2015-10-15.
2015-10-20 VMSA-2015-0003.13
Updated Security advisory in conjunction with the release of
vSphere Data Protection 5.8.3 released on 2015-10-20.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 16127)
Charset: utf-8
wj8DBQFWJoKaDEcm8Vbi9kMRAlEtAJ9omokngcgYhLkpN4F5O4SSO9VtfgCgptKc
rHGAms5DpxIH47ONOboPN/E=
=8Njt
-----END PGP SIGNATURE-----
UPDATE : VMSA-2015-0003.12 – VMware product updates address critical information disclosure issue in JRE.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0003.12
Synopsis: VMware product updates address critical information
disclosure issue in JRE.
Issue date: 2015-04-02
Updated on: 2015-10-15
CVE number: CVE-2014-6593, for other CVEs see JRE reference
- ------------------------------------------------------------------------
1. Summary
VMware product updates address critical information disclosure
issue in JRE.
2. Relevant Releases
Horizon View 6.x or 5.x
Horizon Workspace Portal Server 2.1 or 2.0
Horizon DaaS Platform 6.1.4 or 5.4.5
vCloud Networking and Security prior to 5.5.4.1
vCloud Connector 2.7
vCloud Usage Meter 3.3
vCenter Site Recovery Manager prior to 5.5.1.5 or 5.1.3.1
vCenter Server 6.0, 5.5, 5.1 or 5.0
vRealize Operations Manager 6.0
vCenter Operations Manager 5.8.x or 5.7.x
vCenter Support Assistant 5.5.1.x
vRealize Application Services 6.2 or 6.1
vCloud Application Director 6.0
vRealize Automation 6.2 or 6.1
vCloud Automation Center 6.0.1
vSphere Replication prior to 5.8.0.2, 5.6.0.3, 5.5.1.5 or 5.1.3.1
vRealize Automation 6.2.x or 6.1.x
vRealize Code Stream 1.1 or 1.0
vFabric Postgres 9.3.6.0, 9.2.10.0 or 9.1.15.0
vRealize Hyperic 5.8.x, 5.7.x or 5.0.x
vSphere AppHA Prior to 1.1.x
vSphere Big Data Extensions 2.1 and 2.0
vSphere Data Protection 6.0
vCenter Chargeback Manager 2.7 or 2.6
vRealize Business Adv/Ent 8.1 or 8.0
vRealize Business Standard prior to 1.1.x or 1.0.x
NSX for vSphere 6.1
NSX for Multi-Hypervisor prior to 4.2.4
vCloud Director prior to 5.5.3
vCloud Director Service Providers prior to 5.6.4.1
vCenter Application Discovery Manager 7.0
vRealize Configuration Manager 5.7.x or 5.6.x
vRealize Infrastructure 5.8 or 5.7
vRealize Orchestrator 6.0, 5.5 or 5.1.3.1
vRealize Log Insight 2.5, 2.0, 1.5 or 1.0
vSphere Management Assistant 5.5 or 5.1
vSphere Update Manager 6.0, 5.5, 5.1 or 5.0
EVO:RAIL prior to 1.2.1
3. Problem Description
a. Oracle JRE Update
Oracle JRE is updated in VMware products to address a
critical security issue that existed in earlier releases of
Oracle JRE.
VMware products running JRE 1.7 Update 75 or newer and
JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593,
as documented in the Oracle Java SE Critical Patch Update
Advisory of January 2015.
This advisory also includes the other security issues that
are addressed in JRE 1.7 Update 75 and JRE 1.6 Update 91. The
References section provides a link to the JRE advisory.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2014-6593 to this issue. This
issue is also known as "SKIP" or "SKIP-TLS".
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch**
============= ======= ======= =================
Horizon View 6.x any 6.1
Horizon View 5.x any 5.3.4
Horizon Workspace Portal 2.1 ,2.0 any 2.1.1
Server
Horizon DaaS Platform 6.1 any 6.1.4
Horizon DaaS Platform 5.4 any 5.4.5
vCloud Networking and Security 5.5 any 5.5.4.1*
vCloud Connector 2.7 any 2.7.1*
vCloud Usage Meter 3.3 any 3.3.3*
vCenter Site Recovery Manager 5.5.x any 5.5.1.5***
vCenter Site Recovery Manager 5.1.x any 5.1.3.1***
vCenter Site Recovery Manager 5.0.x any patch pending***
vCenter Server 6.0 any 6.0.0a
vCenter Server 5.5 any Update 2e
vCenter Server 5.1 any Update 3a
vCenter Server 5.0 any Update 3d
vRealize Operations Manager 6.0 any KB2111898
vCenter Operations Manager 5.8.x any KB2111172
vCenter Operations Manager 5.7.x any KB2111172
vCenter Support Assistant 5.5.1.x any 6.0
vRealize Application Services 6.2 any KB2111981
vRealize Application Services 6.1 any KB2111981
vCloud Application Director 6.0 any KB2111981
vCloud Application Director 5.2 any KB2111981
vRealize Automation 6.2 any KB2111658
vRealize Automation 6.1 any KB2111658
vCloud Automation Center 6.0.1 any KB2111658
vRealize Code Stream 1.1 any KB2111658
vRealize Code Stream 1.0 any KB2111658
vPostgres 9.3.x any 9.3.6.0
vPostgres 9.2.x any 9.2.10.0
vPostgres 9.1.x any 9.1.15.0
vSphere Replication 5.8.0 any 5.8.0.2
vSphere Replication 5.6.0 any 5.6.0.3
vSphere Replication 5.5.0 any 5.5.1.5
vSphere Replication 5.1 any 5.1.3.1
vRealize Hyperic 5.8 any KB2111337
vRealize Hyperic 5.7 any KB2111337
vRealize Hyperic 5.0 any KB2111337
vSphere AppHA 1.1 any KB2111336
vSphere Big Data Extensions 2.1 any KB2116604*
vSphere Big Data Extensions 2.0 any KB2116604*
vSphere Data Protection 6.0 any 6.1*
vSphere Data Protection 5.8 any patch pending*
vSphere Data Protection 5.5 any patch pending*
vSphere Data Protection 5.1 any patch pending*
vCenter Chargeback Manager 2.7 any KB2112011*
vCenter Chargeback Manager 2.6 any KB2113178*
vRealize Business Adv/Ent 8.1 any KB2112258*
vRealize Business Adv/Ent 8.0 any KB2112258*
vRealize Business Standard 6.0 any KB2111802
vRealize Business Standard 1.1 any KB2111802
vRealize Business Standard 1.0 any KB2111802
NSX for vSphere 6.1 any 6.1.4*
NSX for Multi-Hypervisor 4.2 any 4.2.4*
vCloud Director 5.5.x any 5.5.3*
vCloud Director For 5.6.4 any 5.6.4.1*
Service Providers
vCenter Application Discovery 7.0 any 7.1*
Manager
vRealize Configuration Manager 5.7.x any KB2111670
vRealize Configuration Manager 5.6 any KB2111670
vRealize Infrastructure 5.8 any 5.8.4
Navigator
vRealize Infrastructure 5.7 any KB2111334*
Navigator
vRealize Orchestrator 6.0 any KB2112028*
vRealize Orchestrator 5.5 any KB2112028*
vRealize Orchestrator 5.1 any 5.1.3.1*
vRealize Log Insight 2.5 any KB2113235*
vRealize Log Insight 2.0 any KB2113235*
vRealize Log Insight 1.5 any KB2113235*
vRealize Log Insight 1.0 any KB2113235*
vSphere Management Assistant 5.5.x any 5.5.0.4
vSphere Management Assistant 5.1.x any 5.1.0.3
vSphere Update Manager 6.0 any 6.0.0a*
vSphere Update Manager 5.5 any Update 2e*
vSphere Update Manager 5.1 any Update 3a*
vSphere Update Manager 5.0 any Update 3d*
EVO:RAIL 1.2.0 any 1.2.1*
* The severity of critical is lowered to important for this product
as is not considered Internet facing
** Knowledge Base (KB) articles provides details of the patches and
how to install them.
*** vCenter Site Recovery Manager 5.0, 5.1, and 5.5 itself do not
include JRE but they include the vSphere Replication appliance
which has JRE. vCenter Site Recovery 5.8 and 6.0 do not include
JRE nor the vSphere Replication appliance.
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
Horizon View 6.1, 5.3.4:
========================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-610-GA&productI
d=492
https://my.vmware.com/web/vmware/details?downloadGroup=VIEW-534-PREMIER&pro
ductId=396
VMware Workspace Portal 2.1.1
=============================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HZNWS211&productId=5
01&rPId=7586
Documentation:
https://www.vmware.com/support/horizon_workspace/doc/wp_release_notes_211.h
tml
Horizon DaaS Platform 6.1.4
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-610-BIN
&productId=405&rPId=6527
Horizon DaaS Platform 5.4.5
===========================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-ONPREM-
540&productId=398&rPId=5214
vCloud Networking and Security 5.5.4.1
======================================
Download:
https://my.vmware.com/web/vmware/details?productId=360&rPId=7625&downloadGr
oup=VCNS5541
Documentation:
https://www.vmware.com/support/vshield/doc/releasenotes_vshield_5541.html
vCloud Connector 2.7.1
======================
Downloads and Documentation:
http://www.vmware.com/support/hybridcloud/doc/hybridcloud_271_rel_notes.htm
l
vCloud Usage Meter 3.3.3
========================
Downloads:
https://my.vmware.com/en/group/vmware/get-download?downloadGroup=UMSV333
vCenter Application Discovery Manager 7.1
=========================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VADM-710-VA&productI
d=300&rPId=8646
Documentation:
https://www.vmware.com/support/adm/doc/vcenter-application-discovery-manage
r-71-release-notes.html
vCenter Site Recovery Manager 5.5.1.5
======================================
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5515&productId=35
7&rPId=7774
https://my.vmware.com/group/vmware/details?downloadGroup=SRM5131&productId=
291&rPId=9236
Documentation:
https://www.vmware.com/support/srm/srm-releasenotes-5-5-1.html
https://www.vmware.com/support/srm/srm-releasenotes-5-1-3-1.html
vCenter Server 6.0, 5.5, 5.1, 5.0
=================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
vRealize Operations Manager 6.0.1
=================================
Downloads and Documentation: http://kb.vmware.com/kb/2111898
vCenter Support Assistant 6.0
=============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?downloadGroup=VCSA600&productId=49
1
vRealize Application Services 6.2, 6.1
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
NSX for vSphere 6.1.4
=====================
Downloads and Documentation:
https://my.vmware.com/web/vmware/details?productId=417&downloadGroup=NSX-V-
614
NSX for Multi-Hypervisor 4.2.4
==============================
Downloads and Documentation:
https://my.vmware.com/web/vmware/info/slug/networking_security/vmware_nsx/4
_x
vCloud Application Director 6.0
======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111981
vCloud Director for Service Providers 5.6.4.1
=============================================
Downloads and Documentation:
https://www.vmware.com/support/pubs/vcd_sp_pubs.html
vCenter Operations Manager 5.8.5, 5.7.4
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111172
vCloud Automation Center 6.0.1.2
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vSphere Replication 5.8.0.2, 5.6.0.3, 5.5.1.5, 5.1.3.1
=============================================
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5802
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5603
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5515
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5131
Documentation:
http://kb.vmware.com/kb/2112025
http://kb.vmware.com/kb/2112022
http://kb.vmware.com/kb/2112012
vRealize Automation 6.2.1, 6.1.1
================================
Downloads and Documentation: http://kb.vmware.com/kb/2111658
vRealize Code Stream 1.1, 1.0
=============================
Downloads and Documentation: http://kb.vmware.com/kb/2111685
vFabric Postgres
================
Downloads
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_936&productId
=373&rPId=7787
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_92_10&product
Id=325&rPId=7788
https://my.vmware.com/group/vmware/details?downloadGroup=VFPG_91_15&product
Id=274&rPId=7789
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3
====================================
Downloads and Documentation: http://kb.vmware.com/kb/KB2111337
vSphere AppHA 1.1.1
===================
Downloads and Documentation: http://kb.vmware.com/kb/2111336
vSphere Big Data Extensions 2.1 and 2.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2116604
vSphere Data Protection 6.1
===========================
Downloads:
https://my.vmware.com/web/vmware/details?productId=491&downloadGroup=VDP61
Documentation:
http://pubs.vmware.com/Release_Notes/en/vdp/61/vdp_610_releasenotes.html
vCenter Chargeback Manager 2.7
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112011
vCenter Chargeback Manager 2.6
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2113178
vRealize Business Adv/Ent 8.1, 8.0
====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112258
vRealize Business Standard 6.0, 1.1 , 1.0
=======================================
Downloads and Documentation: http://kb.vmware.com/kb/2111802
vRealize Configuration Manager 5.7.3
===================================
Downloads and Documentation: http://kb.vmware.com/kb/2111670
vRealize Infrastructure Navigator 5.8.4
=======================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VIN_584&productId=47
6
vRealize Infrastructure Navigator 5.7
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2111334
vRealize Orchestrator 6.0, 5.5
=====================================
Downloads and Documentation: http://kb.vmware.com/kb/2112028
vRealize Orchestrator 5.1.3.1
=============================
Download:
https://my.vmware.com/group/vmware/get-download?downloadGroup=VSP51-VCL-VCO
VA-51U3A
Documentation:
https://www.vmware.com/support/pubs/orchestrator_pubs.html
vSphere Management Assistant 5.5.0.4
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VMA550&productId=352
Documentation: http://kb.vmware.com/kb/2112648
vSphere Management Assistant 5.1.0.3
====================================
Download:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP510-VMA-510&produ
ctId=285
Documentation: http://kb.vmware.com/kb/2112647
vSphere Update Manager 6.0, 5.5, 5.1, 5.0
=========================================
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
EVO:RAIL
========
Downloads and Documentation:
https://my.vmware.com/group/vmware/details?productId=442&downloadGroup=EVOR
AIL1_2_1
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6593
JRE
Oracle Java SE Critical Patch Update Advisory of January 2015
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- ------------------------------------------------------------------------
6. Change log
2015-04-02 VMSA-2015-0003
Initial security advisory in conjunction with the release of VMware
Horizon View 6.1, 5.3.4; vCenter Operations Manager 5.8.5;
vCenter Operations Manager 5.7.4; vCloud Automation Center
6.0.1.2; vSphere Replication 5.8.0.2, 5.6.0.3; vRealize
Automation 6.2.1, 6.1.1; vRealize Code Stream 1.1, 1.0;
vRealize Hyperic 5.8.4, 5.7.2, 5.0.3; vSphere AppHA 1.1.1;
vRealize Business Standard 1.1.1, 1.0.1; vRealize Configuration
Manager prior to 5.7.3; vRealize Infrastructure 5.7, 5.8.4 Patches
released on 2015-04-02.
2015-04-09 VMSA-2015-0003.1
Updated Security advisory in conjunction with the release of VMware
Horizon DaaS Platform 6.1.4, 5.4.5; vRealize Operations Manager 6.0;
vRealize Application Services 6.2; vRealize Application Services 6.1;
vCloud Application Director 6.0; vCenter Chargeback Manager 2.7, 2.6;
vCloud Director For Service Providers 5.6.4.1;
vRealize Log Insight 2.5, 2.0, 1.5, 1.0 Patches
released on 2015-04-09.
2015-04-13 VMSA-2015-0003.2
Updated Security advisory in conjunction with the release of
vRealize Business Adv/Ent 8.1, 8.0 Patches released
on 2015-04-13.
2015-04-16 VMSA-2015-0003.3
Updated Security advisory in conjunction with the release of
vCloud Connector 2.7.1; vCloud Usage Meter 3.3.3;
vCenter Server 6.0, 5.5; vSphere Update Manager 6.0, 5.5 patches
released on 2015-04-16.
2015-04-17 VMSA-2015-0003.4
Updated Security advisory in conjunction with the release of
vCenter Site Recovery Manager 5.5.1.5 patches released on 2015-04-16.
2015-04-23 VMSA-2015-0003.5
Updated Security advisory in conjunction with the release of
NSX for Multi-Hypervisor 4.2.4 and vFabric Postgres 9.3.6.0,
9.2.10.0 or 9.1.15.0 patches released on 2015-04-23.
2015-04-30 VMSA-2015-0003.6
Updated Security advisory in conjunction with the release of
vCloud Networking and Security 5.5.4.1, vCenter Server 5.1 Update 3a,
vCenter Server 5.0 Update 3d, vRealize Orchestrator 5.1.3.1,
vSphere Update Manager 5.1 Update 3a and
vSphere Update Manager 5.0 Update 3d patches released on 2015-04-30.
2015-05-07 VMSA-2015-0003.7
Updated Security advisory in conjunction with the release of
vCenter Support Assistant 6.0, vSphere Big Data Extensions 2.1
and 2.0, NSX for vSphere 6.1.4 patches released on 2015-05-07.
2015-05-08 VMSA-2015-0003.8
Updated Security advisory in conjunction with the release of
vSphere Management Assistant 5.5 and 5.1 patches released
on 2015-05-08.
2015-07-02 VMSA-2015-0003.9
Updated Security advisory in conjunction with the release of
EVO:Rail 1.2.1 patches released on 2015-07-02.
2015-08-14 VMSA-2015-0003.10
Updated Security advisory in conjunction with the release of
vCenter Application Discovery Manager 7.1.0 patches released
on 2015-08-13.
2015-09-10 VMSA-2015-0003.11
Updated Security advisory in conjunction with the release of
VMware vSphere Data Protection 6.1 released on 2015-09-10.
2015-10-15 VMSA-2015-0003.12
Updated Security advisory in conjunction with the release of
vSphere Replication 5.1.3.1 and vCenter Site Recovery Manager
5.1.3.1 released on 2015-10-15.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 16127)
Charset: utf-8
wj8DBQFWH+HFDEcm8Vbi9kMRAgXdAKDe3agOWbyc246oAUhRMZICFgs0ngCg2ocl
efQNP4bkrztIt+Zzq2/tKdo=
=x9WL
-----END PGP SIGNATURE-----
UPDATED VMSA-2015-0007.1 VMware vCenter and ESXi updates address critical security issues
------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2015-0007.1
Synopsis: VMware vCenter and ESXi updates address critical security
issues
Issue date: 2015-10-01
Updated on: 2015-10-06
CVE number: CVE-2015-5177 CVE-2015-2342 CVE-2015-1047
------------------------------------------------------------------------
1. Summary
VMware vCenter and ESXi updates address critical security issues.
2. Relevant Releases
VMware ESXi 5.5 without patch ESXi550-201509101
VMware ESXi 5.1 without patch ESXi510-201510101
VMware ESXi 5.0 without patch ESXi500-201510101
VMware vCenter Server 6.0 prior to version 6.0 update 1
VMware vCenter Server 5.5 prior to version 5.5 update 3
VMware vCenter Server 5.1 prior to version 5.1 update u3b
VMware vCenter Server 5.0 prior to version 5.0 update u3e
3. Problem Description
a. VMWare ESXi OpenSLP Remote Code Execution
VMware ESXi contains a double free flaw in OpenSLP's
SLPDProcessMessage() function. Exploitation of this issue may
allow an unauthenticated attacker to remotely execute code on
the ESXi host.
VMware would like to thank Qinghao Tang of QIHU 360 for reporting
this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-5177 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
==================== ======= =================
ESXi 6.0 ESXi not affected
ESXi 5.5 ESXi ESXi550-201509101 *
ESXi 5.1 ESXi ESXi510-201510101
ESXi 5.0 ESXi ESXi500-201510101
* Customers who have installed the complete set of ESXi 5.5 U3
Bulletins, please review VMware KB 2133118. KB 2133118 documents
a known non-security issue and provides a solution.
b. VMware vCenter Server JMX RMI Remote Code Execution
VMware vCenter Server contains a remotely accessible JMX RMI
service that is not securely configured. An unauthenticated remote
attacker that is able to connect to the service may be able use it
to execute arbitrary code on the vCenter server.
VMware would like to thank Doug McLeod of 7 Elements Ltd and an
anonymous researcher working through HP's Zero Day Initiative for
reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-2342 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= ===============
VMware vCenter Server 6.0 Any 6.0 u1
VMware vCenter Server 5.5 Any 5.5 u3
VMware vCenter Server 5.1 Any 5.1 u3b
VMware vCenter Server 5.0 Any 5.0 u3e
c. VMware vCenter Server vpxd denial-of-service vulnerability
VMware vCenter Server does not properly sanitize long heartbeat
messages. Exploitation of this issue may allow an unauthenticated
attacker to create a denial-of-service condition in the vpxd
service.
VMware would like to thank the Google Security Team for reporting
this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2015-1047 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= ==============
VMware vCenter Server 6.0 Any not affected
VMware vCenter Server 5.5 Any 5.5u2
VMware vCenter Server 5.1 Any 5.1u3
VMware vCenter Server 5.0 Any 5.0u3e
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
ESXi
--------------------------------
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2110247
http://kb.vmware.com/kb/2114875
http://kb.vmware.com/kb/2120209
vCenter Server
--------------------------------
Downloads and Documentation:
https://www.vmware.com/go/download-vsphere
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5177
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2342
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1047
http://kb.vmware.com/kb/2133118
------------------------------------------------------------------------
6. Change log
2015-10-06 VMSA-2015-0007.1
Updated security advisory in conjunction with the release of ESXi 5.5
U3a on 2015-10-06. Added a note to section 3.a to alert customers to
a non-security issue in ESXi 5.5 U3 that is addressed in ESXi 5.5 U3a.
2015-10-01 VMSA-2015-0007
Initial security advisory in conjunction with ESXi 5.0, 5.1 patches
and VMware vCenter Server 5.1 u3b, 5.0 u3e on 2015-10-01.
------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
Consolidated list of VMware Security Advisories
http://kb.vmware.com/kb/2078735
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2015 VMware Inc. All rights reserved.
_______________________________________________
Security-announce mailing list
Security-announce-xEzmwC/hc7si8rCdYzckzA< at >public.gmane.org
http://lists.vmware.com/mailman/listinfo/security-announce