-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VMware Security Advisory Advisory ID: VMSA-2014-0010.13 Synopsis: VMware product updates address critical Bash security vulnerabilities Issue date: 2014-09-30 Updated on: 2014-10-17 CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 - ------------------------------------------------------------------------ 1. Summary VMware product updates address Bash security vulnerabilities. 2. Relevant Releases (Affected products for which remediation is present) ESX 4.1 without patch ESX410-201410401-SG ESX 4.0 without patch ESX400-201410401-SG vCenter Server Appliance prior to 5.5 U2a vCenter Server Appliance prior to 5.1 U2b vCenter Server Appliance prior to 5.0 U3b Horizon DaaS Platform prior to 6.1.1 Horizon DaaS Platform prior to 6.0.2 Horizon DaaS Platform prior to 5.4.3 Horizon Workspace 1.x, 2.x without patch IT Business Management Suite prior to 1.1.0 IT Business Management Suite prior to 1.0.1 NSX for Multi-Hypervisor 4.2.x prior to 4.2.1 NSX for Multi-Hypervisor 4.1.x prior to 4.1.4 NSX for Multi-Hypervisor 4.0.x prior to 4.0.5 NSX for vSphere 6.1.x prior to 6.1.1 NSX for vSphere 6.0.x prior to 6.0.7 NVP 3.x prior to 3.2.4 vCenter Application Discovery Manager without patch vCenter Converter Standalone 5.5.x prior to 5.5.3 vCenter Converter Standalone 5.1.x prior to 5.1.2 vCenter Hyperic Server prior to 5.8.3 vCenter Hyperic Server 5.8.2 without SP3 vCenter Hyperic Server 5.8.1 without SP3 vCenter Hyperic Server 5.8.0 without SP2 vCenter Hyperic Server prior to 5.7.2 vCenter Hyperic Server 5.7.1 without SP1 vCenter Hyperic Server prior to 5.0.3 vCenter Hyperic Server 5.0.2 without SP1 vCenter Infrastructure Navigator prior to 5.8.3 vCenter Infrastructure Navigator prior to 5.7.1 vCenter Infrastructure Navigator prior to 2.0.1 vCenter Log Insight prior to 2.0.5 vCenter Log Insight prior to 2.0U1 vCenter Log Insight prior to 1.5.0U1 vCenter Operations Manager 5.x without patch vCenter Orchestrator Appliance 5.5.x prior to 5.5.2.1 vCenter Orchestrator Appliance 5.1.x, 4.x without patch vCenter Site Recovery Manager prior to 5.5.1.3 vCenter Site Recovery Manager prior to 5.1.2.2 vCenter Support Assistant without patch vCloud Application Director 5.x, 6.x without patch vCloud Automation Center 6.x without patch vCloud Automation Center Application Services 6.x without patch vCloud Director Appliance prior to 5.5.1.3 vCloud Connector prior to 2.6.1 vCloud Networking and Security prior to 5.5.3.1 vCloud Networking and Security prior to 5.1.4.3 vCloud Usage Meter prior to 3.3.2 vFabric Postgres prior to 9.3.5.1 vFabric Postgres prior to 9.2.9.1 vFabric Postgres prior to 9.1.14.1 VMware Application Dependency Planner prior to 2.0.0.1 View Planner prior to 3.0.1.1 VMware Data Recovery prior to 2.0.4 VMware HealthAnalyzer prior to 5.0.3.1 VMware Mirage Gateway prior to 5.1.1 VMware Socialcast On Premise prior to 2-116-1 VMware Socialcast On Premise prior to 2-112-1 VMware Studio 2.x without patch VMware Workbench prior to 3.0.2 vSphere App HA prior to 1.1.1 vSphere App HA 1.1.0 without patch vSphere Big Data Extensions 2.x without patch vSphere Data Protection 5.x without patch vSphere Management Assistant 5.5.x without 5.5 EP1 vSphere Management Assistant 5.1.x without 5.1.0.2 vSphere Management Assistant 5.0.x without 5.0 EP1 vSphere Replication prior to 5.8.0.1 vSphere Replication prior to 5.6.0.2 vSphere Replication prior to 5.5.1.3 vSphere Replication prior to 5.1.2.2 vSphere Storage Appliance prior to 5.5.2 vSphere Storage Appliance 5.1.x without patch 3. Problem Description a. Bash update for multiple products. Bash libraries have been updated in multiple products to resolve multiple critical security issues, also referred to as Shellshock. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 to these issues. VMware products have been grouped into the following four product categories: I) ESXi and ESX Hypervisor ESXi is not affected because ESXi uses the Ash shell (through busybox), which is not affected by the vulnerability reported for the Bash shell. ESX has an affected version of the Bash shell. See table 1 for remediation for ESX. II) Windows-based products Windows-based products, including all versions of vCenter Server running on Windows, are not affected. III) VMware (virtual) appliances VMware (virtual) appliances ship with an affected version of Bash. See table 2 for remediation for appliances. IV) Products that run on Linux, Android, OSX or iOS (excluding virtual appliances) Products that run on Linux, Android, OSX or iOS (excluding virtual appliances) might use the Bash shell that is part of the operating system. If the operating system has a vulnerable version of Bash, the Bash security vulnerability might be exploited through the product. VMware recommends that customers contact their operating system vendor for a patch. MITIGATIONS VMware encourages restricting access to appliances through firewall rules and other network layer controls to only trusted IP addresses. This measure will greatly reduce any risk to these appliances. RECOMMENDATIONS VMware recommends customers evaluate and deploy patches for affected products in Table 1 and 2 below as these patches become available. For several products, both a patch and a product update are available. In general, if a patch is made available, the patch must be applied to the latest version of the appliance. Customers should refer to the specific product Knowledge Base articles listed in Section 4 to understand the type of remediation available and applicable appliance version numbers. Column 4 of the following tables lists the action required to remediate the vulnerability in each release, if a solution is available. Table 1 - ESXi and ESX Hypervisor ================================= VMware Product Running Replace with/ Product Version on Apply Patch ============== ======= ======= ============= ESXi any ESXi Not affected ESX 4.1 ESX ESX410-201410401-SG* ESX 4.0 ESX ESX400-201410401-SG* * VMware has made VMware ESX 4.0 and 4.1 security patches available for the Bash shell vulnerability. This security patch release is an exception to the existing VMware lifecycle policy. Table 2 - Products that are shipped as a (virtual) appliance. ============================================================= VMware Product Running Replace with/ Product Version on Apply Patch ============== ======= ======= ================ vCenter Server Appliance 5.x Linux 5.5 U2a, 5.1 U2b, 5.0 U3b Horizon DaaS Platform 5.x, 6.x Linux 6.1.1, 6.0.2, 5.4.3 Horizon Workspace 1.x, 2.x Linux See Section 4 IT Business Management Suite 1.x Linux 1.1.0, 1.0.1 NSX for Multi-Hypervisor 4.x Linux 4.2.1, 4.1.4 4.0.5 NSX for vSphere 6.x Linux 6.1.1, 6.0.7 NVP 3.x Linux 3.2.4 vCenter Application Discovery 7.x Linux See Section 4 Manager vCenter Converter Standalone 5.x Linux 5.5.3, 5.1.2** vCenter Hyperic Server* 5.x Linux 5.8.3, 5.8.2-SP3, 5.8.1-SP3, 5.8.0-SP2, 5.7.2, 5.7.1-SP1, 5.0.3, 5.0.2-SP1 vCenter Infrastructure Navigator 2.x, 5.x Linux 5.8.3, 5.7.1, 2.0.1 vCenter Log Insight* 1.x, 2.x Linux 2.0.5, 2.0U1, 1.5.0U1 vCenter Operations Manager 5.x Linux See Section 4 vCenter Orchestrator Appliance* 4.x, 5.x Linux 5.5.2.1, 5.1.2, 4.2.3 See Section 4 vCenter Site Recovery Manager 5.x Linux 5.5.1.3, 5.1.2.2, 5.0.x** vCenter Support Assistant 5.x Linux See Section 4 vCloud Application Director 5.x, 6.x Linux See Section 4 vCloud Automation Center 6.x Linux See Section 4 vCloud Automation Center Application Services 6.x Linux See Section 4 vCloud Director Appliance 5.x Linux 5.5.1.3 vCloud Connector 2.x Linux 2.6.1 vCloud Networking and Security 5.x Linux 5.5.3.1, 5.1.4.3 vCloud Usage Meter 3.x Linux 3.3.2 vFabric Postgres 9.x Linux 9.3.5.1, 9.2.9.1, 9.1.14.1 View Planner 3.x Linux 3.0.1.1 VMware Application Dependency x.x Linux 2.0.0.1 Planner VMware Data Recovery 2.x Linux 2.0.4 VMware HealthAnalyzer 5.x Linux 5.0.3.1 VMware Mirage Gateway 5.x Linux 5.1.1 VMware Socialcast On Premise 2.x Linux 2-116-1, 2-112-1 VMware Studio 2.x Linux See Section 4 VMware Workbench 3.0.x Linux 3.0.2 vSphere App HA* 1.x Linux 1.1.1 vSphere Big Data Extensions 2.x Linux See Section 4 vSphere Data Protection 5.x Linux See Section 4 vSphere Management Assistant 5.x Linux 5.5 EP1, 5.1.0.2, 5.0 EP1 vSphere Replication 5.x Linux 5.8.0.1, 5.6.0.2, 5.5.1.3, 5.1.2.2 vSphere Storage Appliance* 5.x Linux 5.5.2, 5.1.3 See Section 4 * This product has patches available to update bash manually as well as a full installation that includes the bash fix for some versions. Either installing the patch or upgrading the appliance will remediate the "shellshock" vulnerability. See documentation in Section 4 for details. ** This product includes Virtual Appliances that will be updated, the product itself is not a Virtual Appliance. 4. Solution ESX --- Downloads: https://www.vmware.com/patchmgr/findPatch.portal Documentation: http://kb.vmware.com/kb/2090859 http://kb.vmware.com/kb/2090853 vCenter Server Appliance ------------------------ Downloads: https://my.vmware.com/web/vmware/details?productId=353&downloadGroup=VC55U2 (scroll down to 5.5 Update 2a Appliance) https://my.vmware.com/web/vmware/details?productId=285&downloadGroup=VCL-VS P510-VC-51U2A (scroll down to 5.1 Update 2b Appliance) https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VC50U3 A (scroll down to 5.0 Update 3b Appliance) Documentation: http://kb.vmware.com/kb/2091085 http://kb.vmware.com/kb/2091018 http://kb.vmware.com/kb/2091017 Horizon DaaS Platform --------------------- Downloads: https://my.vmware.com/web/vmware/details?productId=405&rPId=6527&downloadGr oup=HORIZON-DAAS-610-BIN https://my.vmware.com/web/vmware/details?productId=405&downloadGroup=HORIZO N-DAAS-602 https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-ONPREM- 540&productId=398 Documentation: http://kb.vmware.com/kb/2091183 Horizon Workspace ----------------- Downloads: (Scroll down to the relevant download) Workspace Portal 2.1.0 -> https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGr oup=HZNP210 Workspace Portal 2.0.0 -> https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGr oup=HZNWS200 Horizon Workspace 1.8.2 -> https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr oup=HZNWS182 Horizon Workspace 1.8.1 -> https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr oup=HZNWS181 Horizon Workspace 1.8.0 -> https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr oup=HZNWS180 Horizon Workspace 1.5.2 -> https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr oup=HZNWS152 Horizon Workspace 1.5.1 -> https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr oup=HZNWS151 Horizon Workspace 1.5.0 -> https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr oup=HZNWS150 Documentation: http://kb.vmware.com/kb/2091067 IT Business Management Suite ---------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-110&product Id=384&rPId=6384 https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-101&product Id=385&rPId=6333 Documentation: http://kb.vmware.com/kb/2091014 http://kb.vmware.com/kb/2091013 NSX for Multi-Hypervisor ------------------------ Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=NSX-MH-421 https://my.vmware.com/web/vmware/get-download?downloadGroup=NSX-MH-414 Note: For 4.0.5 refer to http://www.vmware.com/products/nsx Documentation: http://kb.vmware.com/kb/2091179 http://kb.vmware.com/kb/2091205 NSX for vSphere --------------- Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=NSX-V-611 https://my.vmware.com/web/vmware/get-download?downloadGroup=NSX-V-607 Documentation: http://kb.vmware.com/kb/2091213 http://kb.vmware.com/kb/2091216 NVP --- Downloads and Documentation: http://www.vmware.com/products/nsxvCenter Application Discovery Manager ------------------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VADM-700-VA&productI d=300&rPId=3036 Documentation: http://kb.vmware.com/kb/2092300 vCenter Converter Standalone ---------------------------- Downloads: https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage ment/vmware_vcenter_converter_standalone/5_5 https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage ment/vmware_vcenter_converter_standalone/5_1 Documentation: http://kb.vmware.com/kb/2091104 http://kb.vmware.com/kb/2091102 vCenter Hyperic Server ---------------------- Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=VCHQ_583_AGENT https://my.vmware.com/web/vmware/get-download?downloadGroup=VCHQ_583_SERVER https://my.vmware.com/web/vmware/details?productId=378&rPId=6386&downloadGr oup=VCHQ_582_SERVER https://my.vmware.com/web/vmware/details?productId=378&rPId=6386&downloadGr oup=VCHQ_581_SERVER https://my.vmware.com/web/vmware/details?productId=378&rPId=6386&downloadGr oup=VCHQ_580_SERVER https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_572_AGENT https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_572 https://my.vmware.com/web/vmware/details?productId=346&rPId=6849&downloadGr oup=VFHQ_571 https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_503_AGENT https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_503_SERVER https://my.vmware.com/web/vmware/details?productId=311&rPId=6848&downloadGr oup=VFHQ_502 Documentation: http://kb.vmware.com/kb/2091109 http://kb.vmware.com/kb/2091210 http://kb.vmware.com/kb/2091372 http://kb.vmware.com/kb/2091373 http://kb.vmware.com/kb/2091206 http://kb.vmware.com/kb/2091223 http://kb.vmware.com/kb/2091207 http://kb.vmware.com/kb/2091224 vCenter Infrastructure Navigator -------------------------------- Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=VIN_583 https://my.vmware.com/web/vmware/get-download?downloadGroup=VIN_571 https://my.vmware.com/web/vmware/get-download?downloadGroup=VIN_201 Documentation: http://kb.vmware.com/kb/2091095 http://kb.vmware.com/kb/2091093 http://kb.vmware.com/kb/2091108 vCenter Log Insight ------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=STRATA205&productId= 412&rPId=6888 https://my.vmware.com/web/vmware/details?downloadGroup=STRATA20&productId=4 12&rPId=5804 https://my.vmware.com/web/vmware/details?downloadGroup=STRATA15&productId=3 86&rPId=4787 Documentation: http://kb.vmware.com/kb/2091622 http://kb.vmware.com/kb/2091065 vCenter Operations Manager -------------------------- Downloads: https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGr oup=VCOPS-583-STD https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGr oup=VCOPS-582-STD https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGr oup=VCOPS-581-STD https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGr oup=VCOPS-580-STD https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGr oup=VCOPS-573-STD https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGr oup=VCOPS-572-STD https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGr oup=VCOPS-571-STD https://my.vmware.com/web/vmware/details?productId=332&rPId=6743&downloadGr oup=VCOPS-570-STD Documentation: http://kb.vmware.com/kb/2091083 http://kb.vmware.com/kb/2091002 (5.7.0, 5.7.1, 5.7.2, 5.7.3) http://kb.vmware.com/kb/2091401 (5.8.0, 5.8.1, 5.8.2) vCenter Orchestrator Appliance ------------------------------ Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VCL_VCOVA_5521&produ ctId=353&rPId=6655 Documentation: http://kb.vmware.com/kb/2091036 vCenter Site Recovery Manager ----------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=SRM5513&productId=35 7&rPId=6636 https://my.vmware.com/web/vmware/details?downloadGroup=SRM5122&productId=29 1&rPId=6631 Documentation: http://kb.vmware.com/kb/2091038 http://kb.vmware.com/kb/2091039 http://kb.vmware.com/kb/2091037 (5.0.x) vCenter Support Assistant ------------------------- Downloads and Documentation: http://kb.vmware.com/kb/2091112 vCloud Application Director --------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=APPDIR_601_GA&produc tId=383&rPId=6216 https://my.vmware.com/web/vmware/details?downloadGroup=VFAPPDIR_520_GA&prod uctId=345&rPId=3789 Documentation: http://kb.vmware.com/kb/2091129 vCloud Automation Center ------------------------ Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-610&productId=4 47&rPId=6501 https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-6012&productId= 383&rPId=6216 Documentation: http://kb.vmware.com/kb/2091012 vCloud Automation Center Application Services --------------------------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=APPSER_610&productId =447&rPId=6501 Documentation: http://kb.vmware.com/kb/2091129 vCloud Director Appliance ------------------------- Downloads: www.vmware.com/go/try-vcloud-director Documentation: http://kb.vmware.com/kb/2091071 vCloud Connector ---------------- Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=VCC261-GA Documentation: http://kb.vmware.com/kb/2091045 vCloud Networking and Security ------------------------------ Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=VCNS5531 https://my.vmware.com/web/vmware/get-download?downloadGroup=VCNS5143 Documentation: http://kb.vmware.com/kb/2091218 http://kb.vmware.com/kb/2091217 vCloud Usage Meter ------------------ Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=UMSV332 Documentation: http://kb.vmware.com/kb/2091184 vFabric Postgres ---------------- Downloads: https://my.vmware.com/web/vmware/info/slug/application_platform/vmware_vfab ric_postgres/9_3 https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfab ric_postgres/9_2 https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfab ric_postgres/9_1 Documentation: http://kb.vmware.com/kb/2091055 View Planner ------------ View Planner Benchmark Mode Downloads: https://my.vmware.com/web/vmware/details?productId=320&downloadGroup=VIEW-P LAN-300 Documentation: http://kb.vmware.com/kb/2091281 View Planner Flexible Mode Downloads and Documentation: https://na6.salesforce.com/06980000001EUza VMware Application Dependency Planner ------------------------------------- Downloads and Documentation: https://na6.salesforce.com/06980000001EUzQ VMware Data Recovery -------------------- Downloads: https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VDR204 Documentation: http://kb.vmware.com/kb/2091015 VMware HealthAnalyzer --------------------- Downloads and Documentation: https://na6.salesforce.com/06980000001EUzV VMware Mirage Gateway --------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=MIRAGE-510&productId =407&rPId=6565 (See VMware Mirage Gateway Software) Documentation: http://kb.vmware.com/kb/2091090 VMware Socialcast On Premise ---------------------------- Downloads and Documentation: Please contact Global Support Services via My VMware VMware Studio ------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=STUDIO2600GA&product Id=230 Documentation: http://kb.vmware.com/kb/2091990 VMware Workbench ---------------- Downloads and Documentation: https://developercenter.vmware.com/group/workbench/vm/3.0 vSphere App HA -------------- Downloads: https://my.vmware.com/web/vmware/get-download?downloadGroup=APPHA-111 https://my.vmware.com/web/vmware/details?downloadGroup=APPHA-110&productId= 408&rPId=5635 Documentation: http://kb.vmware.com/kb/2091087 http://kb.vmware.com/kb/2091371 vSphere Big Data Extensions --------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=BDE_200_GA&productId =353&rPId=6657 Documentation and Release Notes: http://kb.vmware.com/kb/2091050 https://www.vmware.com/support/bigdataextensions/doc/vsphere-big-data-exten sions-20-release-notes.html https://www.vmware.com/support/bigdataextensions/doc/vsphere-big-data-exten sions-11-release-notes.html https://www.vmware.com/support/bigdataextensions/doc/vsphere-big-data-exten sions-10-release-notes.html vSphere Data Protection ----------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VDP58_0&productId=35 3&rPId=6654 https://my.vmware.com/web/vmware/details?productId=353&rPId=6654&downloadGr oup=VDP55_6 https://my.vmware.com/web/vmware/details?downloadGroup=VDPADV51_21&productI d=330&rPId=3818 https://my.vmware.com/web/vmware/details?downloadGroup=VDP51_11&productId=2 85 Documentation: http://kb.vmware.com/kb/2091341 vSphere Management Assistant ---------------------------- Downloads: Download available via online vMA update mechanism and at: https://my.vmware.com/web/vmware/details?productId=352&downloadGroup=VMA550 https://my.vmware.com/web/vmware/details?productId=285&downloadGroup=VSP510 - -VMA-510 https://my.vmware.com/web/vmware/details?productId=352&downloadGroup=VMA50 Documentation: http://kb.vmware.com/kb/2079150http://kb.vmware.com/kb/2091620 http://kb.vmware.com/kb/2079151 vSphere Replication ------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VR5801&productId=353 &rPId=6654 https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5602 https://my.vmware.com/web/vmware/details?productId=353&rPId=5721&downloadGr oup=VR5513 https://my.vmware.com/web/vmware/details?downloadGroup=VR5122&productId=285 &rPId=6779 Documentation: http://kb.vmware.com/kb/2091019 http://kb.vmware.com/kb/2091031 http://kb.vmware.com/kb/2091033 http://kb.vmware.com/kb/2091035 vSphere Storage Appliance ------------------------- Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VSP55-VSA-552&produc tId=354&rPId=6585 https://my.vmware.com/web/vmware/details?downloadGroup=VSP51-VSA-513&produc tId=297&rPId=3752 Documentation: http://kb.vmware.com/kb/2091000 http://kb.vmware.com/kb/2091086 5. References VMware Knowledge Base Article 2090740 http://kb.vmware.com/kb/2090740 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 , http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278 - ------------------------------------------------------------------------ 6. Change Log 2014-09-30 VMSA-2014-0010 Initial security advisory in conjunction with the release of vCenter Log Insight 2.0 U1 on 2014-09-30. 2014-10-01 VMSA-2014-0010.1 Updated advisory in conjunction with the release of ESX 4.x patches, vCenter Server Appliance 5.5 U2a, 5.1 U2b, and 5.0 U3b, vCloud Director Appliance 5.5.1.3, VMware Data Recovery 2.0.4, VMware Mirage Gateway 5.1.1 and vSphere Storage Appliance 5.5.2 on 2014-10-01. Added CVE-2014-6277 and CVE-2014-6278 as they have been confirmed to be mitigated. 2014-10-01 VMSA-2014-0010.2 Updated advisory in conjunction with the release of Horizon Workspace patches, IT Business Management Suite 1.1.0 and 1.0.1, vCenter Operations Manager patches, vCenter Site Recovery Manager 5.5.1.3 and 5.1.2.2, vCloud Application Director patches, vCloud Automation Center patches, vCloud Automation Center Application Services patches, vCloud Director Appliance 5.5.1.3, vFabric Postgres 9.3.5.1, 9.2.9.1, and 9.1.14.1, vSphere Replication 5.8.0.1, 5.5.1.3, and 5.1.2.2 on 2014-10-01. 2014-10-02 VMSA-2014-0010.3 Updated advisory in conjunction with the release of vCenter Hyperic Server 5.8.3, 5.7.2, and 5.0.3, vCenter Infrastructure Navigator 5.8.3, 5.7.1, and 2.0.1 vCenter Orchestrator Appliance patches, vCenter Support Assistant patches, vSphere App HA 1.1.1, vSphere Management Assistant 5.5 EP1 and 5.0 EP1 and vSphere Storage Appliance patches on 2014-10-02. 2014-10-02 VMSA-2014-0010.4 Updated advisory in conjunction with the release of Horizon DaaS Platform 6.1.1, 6.0.2, and 5.4.3, vCenter Orchestrator Appliance 5.5.2.1, vCloud Connector 2.6.1, vCloud Usage Meter 3.3.2, and vSphere Replication 5.6.0.2 on 2014-10-02. 2014-10-03 VMSA-2014-0010.5 Updated advisory in conjunction with the release of vCloud Networking and Security 5.5.3.1 and 5.1.4.3 on 2014-10-03. 2014-10-04 VMSA-2014-0010.6 Updated advisory in conjunction with the release of NSX for Multi-Hypervisor 4.2.1, 4.1.4, and 4.0.5, NSX for vSphere 6.1.1 and 6.0.7, NVP 3.2.4, and vSphere Big Data Extensions 2.x patch on 2014-10-04. 2014-10-05 VMSA-2014-0010.7 Updated advisory in conjunction with the release of View Planner Benchmark 3.0.1.1 and vSphere Data Protection 5.x patch on 2014-10-05. 2014-10-06 VMSA-2014-0010.8 Updated advisory in conjunction with the release of vCenter Hyperic Server 5.8.2 SP3, 5.8.1 SP3, 5.8.0 SP2, 5.7.1 SP1, and 5.0.2 SP1, vCenter Log Insight 1.5.0U1, View Planner Flexible 3.0.1.1,VMware Application Dependency Planner 2.0.0.1, VMware HealthAnalyzer 5.0.3.1, vSphere App HA 1.1.0 patch on 2014-10-06. 2014-10-07 VMSA-2014-0010.9 Updated advisory in conjunction with the release of vCenter Operations Manager patches, VMware Socialcast On Premise 2-116-1 and 2-112-1, and vSphere Data Protection patches on 2014-10-07. 2014-10-08 VMSA-2014-0010.10 Updated advisory in conjunction with the release of vCenter Operations Manager patches on 2014-10-08. 2014-10-09 VMSA-2014-0010.11 Updated advisory in conjunction with the release of vCenter Converter Standalone 5.5.3 and 5.1.2, and vCenter Log Insight 2.0.5 on 2014-10-09. 2014-10-13 VMSA-2014-0010.12 Updated advisory in conjunction with the release of VMware Studio 2.x patch on 2014-10-13. 2014-10-17 VMSA-2014-0010.13 Updated advisory in conjunction with the release of vCenter Application Discovery Manager 7.0 patch, vSphere Management Assistant 5.1.0.2, and VMware Workbench 3.0.2 on 2014-10-17. - ------------------------------------------------------------------------ 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce at lists.vmware.com bugtraq at securityfocus.com fulldisclosure at seclists.org E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Policy https://www.vmware.com/support/policies/lifecycle.html Twitter https://twitter.com/VMwareSRC Copyright 2014 VMware Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.0 (Build 8741) Charset: utf-8 wj8DBQFUQWIsDEcm8Vbi9kMRAoR1AKDHn4S//eq+oPtAM0Px2RFI2jRKMACfTPP/ QDo4EkX1su4YYHHrsrFZLXk= =GHiK -----END PGP SIGNATURE-----