VMWare

NEW VMSA-2016-0006 VMware vCenter Server updates address an important cross-site scripting issue

Leave a comment 
?-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
VMware Security Advisory

Advisory ID: VMSA-2016-0006
Synopsis:    VMware vCenter Server updates address an important cross-site
             scripting issue

Issue date:  2016-05-24
Updated on:  2016-05-24 (Initial Advisory)
CVE number:  CVE-2016-2078

1. Summary

   VMware vCenter Server updates address an important cross-site scripting
issue.

2. Relevant Releases

   vCenter Server 6.0 prior to 6.0 update 2
   vCenter Server 5.5 prior to 5.5 update 3d
   vCenter Server 5.1 prior to 5.1 update 3d

3. Problem Description

   a. Reflected cross-site scripting issue through flash parameter
injection

   The vSphere Web Client contains a reflected cross-site scripting
   vulnerability that occurs through flash parameter injection. An attacker
   can exploit this issue by tricking a victim into clicking a malicious
link.

   VMware would like to thank John Page aka hyp3rlinx for reporting this
issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
   assigned the identifier CVE-2016-2078 to this issue.

   Column 4 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is
   available.

   VMware              Product       Running      Replace with/
   Product             Version         on          Apply Patch
   ============       ==========    ==========    =============
   vCenter Server       6.0          Window         6.0 U2*
   vCenter Server       6.0          Linux          not affected
   vCenter Server       5.5          Window         5.5 U3d*
   vCenter Server       5.5          Linux          not affected
   vCenter Server       5.1          Window         5.1 U3d*
   vCenter Server       5.1          Linux          not affected
   vCenter Server       5.0          any            not affected

   *Client side component of the vSphere Web Client does not need to be
updated to remediate CVE-2016-2078. Updating the vCenter Server is sufficient
to remediate this issue.


4. Solution

   Please review the patch/release notes for your product and
   version and verify the checksum of your downloaded file.

   vCenter Server
   --------------
   Downloads and Documentation:
   https://www.vmware.com/go/download-vsphere


5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2078

- ------------------------------------------------------------------------

6. Change log

   2016-05-24 VMSA-2016-0006
   Initial security advisory in conjunction with the release of VMware
   vCenter Server 5.1 U3d on 2016-05-24.

- ------------------------------------------------------------------------

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

   security-announce at lists.vmware.com
   bugtraq at securityfocus.com
   fulldisclosure at seclists.org

   E-mail: security at vmware.com
   PGP key at: https://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   Consolidated list of VMware Security Advisories
   http://kb.vmware.com/kb/2078735

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Support Phases
   https://www.vmware.com/support/policies/lifecycle.html

   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2016 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 21165)
Charset: utf-8

wj8DBQFXQ9NcDEcm8Vbi9kMRAqwrAJ9b7+p4TGNBRGhHQUFmYsawBbOp5wCg0/aw
NRfGidYCwwF9ALq6OGrnMAU=
=j89F
-----END PGP SIGNATURE-----



_______________________________________________
Security-announce mailing list
Security-announce-xEzmwC/hc7si8rCdYzckzA< at >public.gmane.org
http://lists.vmware.com/mailman/listinfo/security-announce

Leave a Reply