-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2014-0010
Synopsis: VMware product updates address critical Bash
security vulnerabilities
Issue date: 2014-09-30
Updated on: 2014-09-30 (Initial Advisory)
CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186,
CVE-2014-7187
- ------------------------------------------------------------------------
1. Summary
VMware product updates address Bash security vulnerabilities.
2. Relevant Releases (Affected products for which remediation is present)
vCenter Log Insight 2.0
3. Problem Description
a. Bash update for multiple products.
Bash libraries have been updated in multiple products to resolve
multiple critical security issues, also referred to as Shellshock.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifiers CVE-2014-6271, CVE-2014-7169,
CVE-2014-7186, and CVE-2014-7187 to these issues.
VMware products have been grouped into the following four
product categories:
I) ESXi and ESX Hypervisor
ESXi is not affected because ESXi uses the Ash shell (through
busybox), which is not affected by the vulnerability reported
for the Bash shell.
ESX has an affected version of the Bash shell. See table 1 for
remediation for ESX.
II) Windows-based products
Windows-based products, including all versions of vCenter Server
running on Windows, are not affected.
III) VMware (virtual) appliances
VMware (virtual) appliances ship with an affected version of Bash.
See table 2 for remediation for appliances.
IV) Products that run on Linux, Android, OSX or iOS (excluding
virtual
appliances)
Products that run on Linux, Android, OSX or iOS (excluding
virtual appliances) might use the Bash shell that is part of the
operating system. If the operating system has a vulnerable
version of Bash, the Bash security vulnerability might be
exploited through the product. VMware recommends that customers
contact their operating system vendor for a patch.
MITIGATIONS
VMware encourages restricting access to appliances through
firewall rules and other network layer controls to only trusted IP
addresses. This measure will greatly reduce any risk to these
appliances.
RECOMMENDATIONS
VMware recommends customers evaluate and deploy patches for
affected products in Table 1 and 2 below as these
patches become available.
Column 4 of the following tables lists the action required to
remediate the vulnerability in each release, if a solution is
available.
Table 1 - ESXi and ESX Hypervisor
=================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= =============
ESXi any ESXi Not affected
ESX 4.1 ESX Patch pending *
ESX 4.0 ESX Patch pending *
* VMware will make VMware ESX 4.0 and 4.1 security patches available
for the Bash shell vulnerability. This security patch release is an
exception to the existing VMware lifecycle policy.
Table 2 - Products that are shipped as a (virtual) appliance.
=============================================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= =============
vCenter Server Appliance 5.x Linux Patch Pending
Horizon DaaS Platform 6.x Linux Patch Pending
Horizon Workspace 1.x, 2.x Linux Patch Pending
IT Business Management Suite 1.x Linux Patch Pending
NSX for Multi-Hypervisor 4.x Linux Patch Pending
NSX for vSphere 6.x Linux Patch Pending
NVP 3.x Linux Patch Pending
vCenter Converter Standalone 5.x Linux Patch Pending
vCenter Hyperic Server 5.x Linux Patch Pending
vCenter Infrastructure Navigator 5.x Linux Patch Pending
vCenter Log Insight 1.x, 2.x Linux 2.0 U1
vCenter Operations Manager 5.x Linux Patch Pending
vCenter Orchestrator Appliance 4.x, 5.x Linux Patch Pending
vCenter Site Recovery Manager 5.x Linux Patch Pending
**
vCenter Support Assistant 5.x Linux Patch Pending
vCloud Automation Center 6.x Linux Patch Pending
vCloud Automation Center
Application Services 6.x Linux Patch Pending
vCloud Director Appliance 5.x Linux Patch Pending
vCloud Connector 2.x Linux Patch Pending
vCloud Networking and Security 5.x Linux Patch Pending
vCloud Usage Meter 3.x Linux Patch Pending
vFabric Application Director 5.x, 6.x Linux Patch Pending
vFabric Postgres 9.x Linux Patch Pending
Viewplanner 3.x Linux Patch Pending
VMware Application Dependency
Planner x.x Linux Patch Pending
VMware Data Recovery 2.x Linux Patch Pending
VMware HealthAnalyzer 5.x Linux Patch Pending
VMware Mirage Gateway 5.x Linux Patch Pending
VMware Socialcast On Premise x.x Linux Patch Pending
VMware Studio 2.x Linux Patch Pending
VMware TAM Data Manager x.x Linux Patch Pending
VMware Workbench 3.x Linux Patch Pending
vSphere App HA 1.x Linux Patch Pending
vSphere Big Data Extensions 1.x, 2.x Linux Patch Pending
vSphere Data Protection 5.x Linux Patch Pending
vSphere Management Assistant 5.x Linux Patch Pending
vSphere Replication 5.x Linux Patch Pending
vSphere Storage Appliance 5.x Linux Patch Pending
** This product includes Virtual Appliances that will be updated, the
product
itself is not a Virtual Appliance.
4. Solution
vCenter Log Insight
----------------------------
Downloads:
https://www.vmware.com/go/download-vcenter-log-insight
(click Go to Downloads)
Documentation:
http://kb.vmware.com/kb/2091065
5. References
VMware Knowledge Base Article 2090740
http://kb.vmware.com/kb/2090740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 ,
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
- ------------------------------------------------------------------------
6. Change Log
2014-09-30 VMSA-2014-0010
Initial security advisory in conjunction with the release of
vCenter Log Insight 2.0 U1 on 2014-09-30.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Policy
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8
wj8DBQFUK2DqDEcm8Vbi9kMRAg4rAJ9wKbbbxeD3cagCry7GGfR4fVLpDwCeMqYm
SfX/140WMvqvcmkPX2chR9s=
=1KVR
-----END PGP SIGNATURE-----
Monthly Archives: September 2014
NEW VMSA-2014-0010 – VMware product updates address critical Bash security vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2014-0010
Synopsis: VMware product updates address critical Bash
security vulnerabilities
Issue date: 2014-09-30
Updated on: 2014-09-30 (Initial Advisory)
CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186,
CVE-2014-7187
- ------------------------------------------------------------------------
1. Summary
VMware product updates address Bash security vulnerabilities.
2. Relevant Releases (Affected products for which remediation is present)
vCenter Log Insight 2.0
3. Problem Description
a. Bash update for multiple products.
Bash libraries have been updated in multiple products to resolve
multiple critical security issues, also referred to as Shellshock.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifiers CVE-2014-6271, CVE-2014-7169,
CVE-2014-7186, and CVE-2014-7187 to these issues.
VMware products have been grouped into the following four
product categories:
I) ESXi and ESX Hypervisor
ESXi is not affected because ESXi uses the Ash shell (through
busybox), which is not affected by the vulnerability reported
for the Bash shell.
ESX has an affected version of the Bash shell. See table 1 for
remediation for ESX.
II) Windows-based products
Windows-based products, including all versions of vCenter Server
running on Windows, are not affected.
III) VMware (virtual) appliances
VMware (virtual) appliances ship with an affected version of Bash.
See table 2 for remediation for appliances.
IV) Products that run on Linux, Android, OSX or iOS (excluding
virtual
appliances)
Products that run on Linux, Android, OSX or iOS (excluding
virtual appliances) might use the Bash shell that is part of the
operating system. If the operating system has a vulnerable
version of Bash, the Bash security vulnerability might be
exploited through the product. VMware recommends that customers
contact their operating system vendor for a patch.
MITIGATIONS
VMware encourages restricting access to appliances through
firewall rules and other network layer controls to only trusted IP
addresses. This measure will greatly reduce any risk to these
appliances.
RECOMMENDATIONS
VMware recommends customers evaluate and deploy patches for
affected products in Table 1 and 2 below as these
patches become available.
Column 4 of the following tables lists the action required to
remediate the vulnerability in each release, if a solution is
available.
Table 1 - ESXi and ESX Hypervisor
=================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= =============
ESXi any ESXi Not affected
ESX 4.1 ESX Patch pending *
ESX 4.0 ESX Patch pending *
* VMware will make VMware ESX 4.0 and 4.1 security patches available
for the Bash shell vulnerability. This security patch release is an
exception to the existing VMware lifecycle policy.
Table 2 - Products that are shipped as a (virtual) appliance.
=============================================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= =============
vCenter Server Appliance 5.x Linux Patch Pending
Horizon DaaS Platform 6.x Linux Patch Pending
Horizon Workspace 1.x, 2.x Linux Patch Pending
IT Business Management Suite 1.x Linux Patch Pending
NSX for Multi-Hypervisor 4.x Linux Patch Pending
NSX for vSphere 6.x Linux Patch Pending
NVP 3.x Linux Patch Pending
vCenter Converter Standalone 5.x Linux Patch Pending
vCenter Hyperic Server 5.x Linux Patch Pending
vCenter Infrastructure Navigator 5.x Linux Patch Pending
vCenter Log Insight 1.x, 2.x Linux 2.0 U1
vCenter Operations Manager 5.x Linux Patch Pending
vCenter Orchestrator Appliance 4.x, 5.x Linux Patch Pending
vCenter Site Recovery Manager 5.x Linux Patch Pending
**
vCenter Support Assistant 5.x Linux Patch Pending
vCloud Automation Center 6.x Linux Patch Pending
vCloud Automation Center
Application Services 6.x Linux Patch Pending
vCloud Director Appliance 5.x Linux Patch Pending
vCloud Connector 2.x Linux Patch Pending
vCloud Networking and Security 5.x Linux Patch Pending
vCloud Usage Meter 3.x Linux Patch Pending
vFabric Application Director 5.x, 6.x Linux Patch Pending
vFabric Postgres 9.x Linux Patch Pending
Viewplanner 3.x Linux Patch Pending
VMware Application Dependency
Planner x.x Linux Patch Pending
VMware Data Recovery 2.x Linux Patch Pending
VMware HealthAnalyzer 5.x Linux Patch Pending
VMware Mirage Gateway 5.x Linux Patch Pending
VMware Socialcast On Premise x.x Linux Patch Pending
VMware Studio 2.x Linux Patch Pending
VMware TAM Data Manager x.x Linux Patch Pending
VMware Workbench 3.x Linux Patch Pending
vSphere App HA 1.x Linux Patch Pending
vSphere Big Data Extensions 1.x, 2.x Linux Patch Pending
vSphere Data Protection 5.x Linux Patch Pending
vSphere Management Assistant 5.x Linux Patch Pending
vSphere Replication 5.x Linux Patch Pending
vSphere Storage Appliance 5.x Linux Patch Pending
** This product includes Virtual Appliances that will be updated, the
product
itself is not a Virtual Appliance.
4. Solution
vCenter Log Insight
----------------------------
Downloads:
https://www.vmware.com/go/download-vcenter-log-insight
(click Go to Downloads)
Documentation:
http://kb.vmware.com/kb/2091065
5. References
VMware Knowledge Base Article 2090740
http://kb.vmware.com/kb/2090740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 ,
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
- ------------------------------------------------------------------------
6. Change Log
2014-09-30 VMSA-2014-0010
Initial security advisory in conjunction with the release of
vCenter Log Insight 2.0 U1 on 2014-09-30.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Policy
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8
wj8DBQFUK2DqDEcm8Vbi9kMRAg4rAJ9wKbbbxeD3cagCry7GGfR4fVLpDwCeMqYm
SfX/140WMvqvcmkPX2chR9s=
=1KVR
-----END PGP SIGNATURE-----
Announcing the CentOS Cloud SIG
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We are pleased to announce the formal acceptance of the CentOS Cloud SIG by the CentOS Board. The CentOS Cloud SIG aims to focus on building, delivering and maintaing the software needed to run cloud infrastructure on premise. This includes all the integration work that is needed with the hypervisors, the storage controllers, the networking stack around it and the user interface components. In many cases, we will rely on and extend the work being done in the Virtualisation SIG, the Storage SIG and other niche specific efforts as they come up in the CentOS Ecosystem. This effort is being bootstrapped by Kushal Das, a long time open source evangalist and cloud engineer; Helping him are Rich Bowen, Haikel Guemar, Garrett Holmstrom, Jaime Melis, Javier Fontán and I'll be working with the group as CentOS Board liason helping them with infra and process requests as they come up. Given the scope of what we are trying to achieve, we are going to need lots of community participation, and we'd like to start by sending a call out to the larger cloud ecosystem to come and join the effort. The initial conversations are all going to take place on the centos-devel mailing list ( http://lists.centos.org/mailman/listinfo/centos-devel ), please come and join the effort. You can read more about the Special interest group at : http://wiki.centos.org/SpecialInterestGroup/Cloud - -- Karanbir Singh, Project Lead, The CentOS Project -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.14 (GNU/Linux) iQEcBAEBAgAGBQJUK07TAAoJEI3Oi2Mx7xbtEd0H/iUs+f1rx1jwHBhU2/wdKZKz 447DBr0AQCcdJKDXGOZyz2/AOYO9IvC0t1+sGOTtIQNDWtRRHo7vnrHgEo9REK5L 8FddxPbCVGOxe+hm/4A2MCzpEtWL7Ep+P2JSwflUYUdwa0cBWxuFmhyNh4646p9u mmyVeTaMFQCorffdJBb3uDb/Xxh1sPW82P74iCG07BcxQmMe5yk37MHO6uV+ZCtN NscmundpCcykFUzY5xOez+3YtMy9e3X69/xItkYfyEFFiLId8h40hArXnCxK/2V0 hootswOF8ut2bkH6XJdnQm2DaEG3I4m/K5I5uc1mBONal622a4V+UBjcWTcQ3nY= =oE5g -----END PGP SIGNATURE-----
Apple Releases OS X bash Update 1.0
Original release date: September 30, 2014
Apple has released OS X bash Update 1.0 to address vulnerabilities found in the Bourne-again Shell (bash) which could allow a remote attacker to execute arbitrary shell commands.
US-CERT recommends users and administrators review Apple Security Update HT6495, TA14-268A, Vulnerability Note VU#252743 and the Redhat Security Article for additional details.
This product is provided subject to this Notification and this Privacy & Use policy.
DSA-3041 xen – security update
Multiple security issues have been discovered in the Xen virtualisation
solution which may result in denial of service, information disclosure
or privilege escalation.
CVE-2014-6051 (debian_linux, enterprise_linux_server_aus, enterprise_linux_server_eus, fedora, libvncserver, solaris)
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.
CVE-2014-6055 (debian_linux, enterprise_linux_server_aus, enterprise_linux_server_eus, fedora, libvncserver)
Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.
Red Hat Security Advisory 2014-1336-01
Red Hat Security Advisory 2014-1336-01 – OpenStack Dashboard provides administrators and users a graphical interface to access, provision and automate cloud-based resources. The dashboard allows cloud administrators to get an overall view of the size and state of the cloud and it provides end-users a self-service portal to provision their own resources within the limits set by administrators. A persistent cross-site scripting flaw was found in the horizon host aggregate interface. A user with sufficient privileges to add a host aggregate could potentially use this flaw to capture the credentials of another user.
Red Hat Security Advisory 2014-1335-01
Red Hat Security Advisory 2014-1335-01 – OpenStack Dashboard provides administrators and users a graphical interface to access, provision and automate cloud-based resources. The dashboard allows cloud administrators to get an overall view of the size and state of the cloud and it provides end-users a self-service portal to provision their own resources within the limits set by administrators. A persistent cross-site scripting flaw was found in the horizon host aggregate interface. A user with sufficient privileges to add a host aggregate could potentially use this flaw to capture the credentials of another user.
Red Hat Security Advisory 2014-1340-01
Red Hat Security Advisory 2014-1340-01 – In accordance with the Red Hat Enterprise Linux Errata Support Policy, Extended Update Support for Red Hat Enterprise Linux 5.9 will be retired as of March 31, 2015, and support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including Critical impact security patches or urgent priority bug fixes, for Red Hat Enterprise Linux 5.9 EUS after March 31, 2015. In addition, technical support through Red Hat’s Global Support Services will no longer be provided after this date. We encourage customers to plan their migration from Red Hat Enterprise Linux 5.9 to a more recent version of Red Hat Enterprise Linux. As a benefit of the Red Hat subscription model, customers can use their active subscriptions to entitle any system on any currently supported Red Hat Enterprise Linux release.