NEW VMSA-2014-0010 – VMware product updates address critical Bash security vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

VMware Security Advisory

Advisory ID: VMSA-2014-0010
Synopsis:    VMware product updates address critical Bash 
             security vulnerabilities
Issue date:  2014-09-30
Updated on:  2014-09-30 (Initial Advisory)
CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, 
             CVE-2014-7187
- ------------------------------------------------------------------------

1. Summary

   VMware product updates address Bash security vulnerabilities.

2. Relevant Releases (Affected products for which remediation is present)

    vCenter Log Insight 2.0

3. Problem Description 

   a. Bash update for multiple products.

      Bash libraries have been updated in multiple products to resolve 
      multiple critical security issues, also referred to as Shellshock.
  
      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the identifiers CVE-2014-6271, CVE-2014-7169, 
      CVE-2014-7186, and CVE-2014-7187 to these issues.

      VMware products have been grouped into the following four
      product categories:
      
      I) ESXi and ESX Hypervisor
      ESXi is not affected because ESXi uses the Ash shell (through
      busybox), which is not affected by the vulnerability reported
      for the Bash shell.
      ESX has an affected version of the Bash shell. See table 1 for
      remediation for ESX.
    
      II) Windows-based products
      Windows-based products, including all versions of vCenter Server 
      running on Windows, are not affected.

      III) VMware (virtual) appliances
      VMware (virtual) appliances ship with an affected version of Bash. 
      See table 2 for remediation for appliances.
      
      IV) Products that run on Linux, Android, OSX or iOS (excluding
virtual
      appliances)

      Products that run on Linux, Android, OSX or iOS (excluding 
      virtual appliances) might use the Bash shell that is part of the
      operating system. If the operating system has a vulnerable
      version of Bash, the Bash security vulnerability might be
      exploited through the product. VMware recommends that customers
      contact their operating system vendor for a patch.    
      
      MITIGATIONS

      VMware encourages restricting access to appliances through
      firewall rules and other network layer controls to only trusted IP
      addresses. This measure will greatly reduce any risk to these
      appliances.

      RECOMMENDATIONS

      VMware recommends customers evaluate and deploy patches for
      affected products in Table 1 and 2 below as these
      patches become available. 

      Column 4 of the following tables lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

      Table 1 - ESXi and ESX Hypervisor
      =================================

      VMware           Product    Running  Replace with/
      Product          Version    on       Apply Patch 
      ==============   =======    =======  =============
      ESXi             any        ESXi     Not affected

      ESX              4.1        ESX      Patch pending *

      ESX              4.0        ESX      Patch pending *

      * VMware will make VMware ESX 4.0 and 4.1 security patches available 
      for the Bash shell vulnerability. This security patch release is an 
      exception to the existing VMware lifecycle policy.  

      Table 2 - Products that are shipped as a (virtual) appliance. 
      =============================================================

      VMware                             Product    Running  Replace with/
      Product                            Version    on       Apply Patch 
      ==============                     =======    =======  =============
      
      vCenter Server Appliance           5.x        Linux    Patch Pending
      Horizon DaaS Platform              6.x        Linux    Patch Pending
      Horizon Workspace                  1.x, 2.x   Linux    Patch Pending
      IT Business Management Suite       1.x        Linux    Patch Pending
      NSX for Multi-Hypervisor           4.x        Linux    Patch Pending
      NSX for vSphere                    6.x        Linux    Patch Pending
      NVP                                3.x        Linux    Patch Pending
      vCenter Converter Standalone       5.x        Linux    Patch Pending 
      vCenter Hyperic Server             5.x        Linux    Patch Pending
      vCenter Infrastructure Navigator   5.x        Linux    Patch Pending
      vCenter Log Insight                1.x, 2.x   Linux    2.0 U1
      vCenter Operations Manager         5.x        Linux    Patch Pending
      vCenter Orchestrator Appliance     4.x, 5.x   Linux    Patch Pending
      vCenter Site Recovery Manager      5.x        Linux    Patch Pending
**
      vCenter Support Assistant          5.x        Linux    Patch Pending
      vCloud Automation Center           6.x        Linux    Patch Pending
      vCloud Automation Center
      Application Services               6.x        Linux    Patch Pending
      vCloud Director Appliance          5.x        Linux    Patch Pending
      vCloud Connector                   2.x        Linux    Patch Pending
      vCloud Networking and Security     5.x        Linux    Patch Pending
      vCloud Usage Meter                 3.x        Linux    Patch Pending
      vFabric Application Director       5.x, 6.x   Linux    Patch Pending
      vFabric Postgres                   9.x        Linux    Patch Pending
      Viewplanner                        3.x        Linux    Patch Pending
      VMware Application Dependency 
      Planner                            x.x        Linux    Patch Pending
      VMware Data Recovery               2.x        Linux    Patch Pending
      VMware HealthAnalyzer              5.x        Linux    Patch Pending
      VMware Mirage Gateway              5.x        Linux    Patch Pending
      VMware Socialcast On Premise       x.x        Linux    Patch Pending
      VMware Studio                      2.x        Linux    Patch Pending
      VMware TAM Data Manager            x.x        Linux    Patch Pending
      VMware Workbench                   3.x        Linux    Patch Pending
      vSphere App HA                     1.x        Linux    Patch Pending
      vSphere Big Data Extensions        1.x, 2.x   Linux    Patch Pending
      vSphere Data Protection            5.x        Linux    Patch Pending
      vSphere Management Assistant       5.x        Linux    Patch Pending
      vSphere Replication                5.x        Linux    Patch Pending
      vSphere Storage Appliance          5.x        Linux    Patch Pending

     ** This product includes Virtual Appliances that will be updated, the
product 
     itself is not a Virtual Appliance.

   4. Solution

   vCenter Log Insight
   ----------------------------
   Downloads:
   https://www.vmware.com/go/download-vcenter-log-insight
   (click Go to Downloads)
   Documentation:
   http://kb.vmware.com/kb/2091065

5. References
   
   VMware Knowledge Base Article 2090740
   http://kb.vmware.com/kb/2090740

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271        , 
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

- ------------------------------------------------------------------------

6. Change Log

   2014-09-30 VMSA-2014-0010
   Initial security advisory in conjunction with the release of
   vCenter Log Insight 2.0 U1 on 2014-09-30.

- ------------------------------------------------------------------------

 
7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

    security-announce at lists.vmware.com
    bugtraq at securityfocus.com
    fulldisclosure at seclists.org

   E-mail: security at vmware.com
   PGP key at: http://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Policy
   https://www.vmware.com/support/policies/lifecycle.html
 
   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2014 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8

wj8DBQFUK2DqDEcm8Vbi9kMRAg4rAJ9wKbbbxeD3cagCry7GGfR4fVLpDwCeMqYm
SfX/140WMvqvcmkPX2chR9s=
=1KVR
-----END PGP SIGNATURE-----

NEW VMSA-2014-0010 – VMware product updates address critical Bash security vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

VMware Security Advisory

Advisory ID: VMSA-2014-0010
Synopsis:    VMware product updates address critical Bash 
             security vulnerabilities
Issue date:  2014-09-30
Updated on:  2014-09-30 (Initial Advisory)
CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, 
             CVE-2014-7187
- ------------------------------------------------------------------------

1. Summary

   VMware product updates address Bash security vulnerabilities.

2. Relevant Releases (Affected products for which remediation is present)

    vCenter Log Insight 2.0

3. Problem Description 

   a. Bash update for multiple products.

      Bash libraries have been updated in multiple products to resolve 
      multiple critical security issues, also referred to as Shellshock.
  
      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the identifiers CVE-2014-6271, CVE-2014-7169, 
      CVE-2014-7186, and CVE-2014-7187 to these issues.

      VMware products have been grouped into the following four
      product categories:
      
      I) ESXi and ESX Hypervisor
      ESXi is not affected because ESXi uses the Ash shell (through
      busybox), which is not affected by the vulnerability reported
      for the Bash shell.
      ESX has an affected version of the Bash shell. See table 1 for
      remediation for ESX.
    
      II) Windows-based products
      Windows-based products, including all versions of vCenter Server 
      running on Windows, are not affected.

      III) VMware (virtual) appliances
      VMware (virtual) appliances ship with an affected version of Bash. 
      See table 2 for remediation for appliances.
      
      IV) Products that run on Linux, Android, OSX or iOS (excluding
virtual
      appliances)

      Products that run on Linux, Android, OSX or iOS (excluding 
      virtual appliances) might use the Bash shell that is part of the
      operating system. If the operating system has a vulnerable
      version of Bash, the Bash security vulnerability might be
      exploited through the product. VMware recommends that customers
      contact their operating system vendor for a patch.    
      
      MITIGATIONS

      VMware encourages restricting access to appliances through
      firewall rules and other network layer controls to only trusted IP
      addresses. This measure will greatly reduce any risk to these
      appliances.

      RECOMMENDATIONS

      VMware recommends customers evaluate and deploy patches for
      affected products in Table 1 and 2 below as these
      patches become available. 

      Column 4 of the following tables lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

      Table 1 - ESXi and ESX Hypervisor
      =================================

      VMware           Product    Running  Replace with/
      Product          Version    on       Apply Patch 
      ==============   =======    =======  =============
      ESXi             any        ESXi     Not affected

      ESX              4.1        ESX      Patch pending *

      ESX              4.0        ESX      Patch pending *

      * VMware will make VMware ESX 4.0 and 4.1 security patches available 
      for the Bash shell vulnerability. This security patch release is an 
      exception to the existing VMware lifecycle policy.  

      Table 2 - Products that are shipped as a (virtual) appliance. 
      =============================================================

      VMware                             Product    Running  Replace with/
      Product                            Version    on       Apply Patch 
      ==============                     =======    =======  =============
      
      vCenter Server Appliance           5.x        Linux    Patch Pending
      Horizon DaaS Platform              6.x        Linux    Patch Pending
      Horizon Workspace                  1.x, 2.x   Linux    Patch Pending
      IT Business Management Suite       1.x        Linux    Patch Pending
      NSX for Multi-Hypervisor           4.x        Linux    Patch Pending
      NSX for vSphere                    6.x        Linux    Patch Pending
      NVP                                3.x        Linux    Patch Pending
      vCenter Converter Standalone       5.x        Linux    Patch Pending 
      vCenter Hyperic Server             5.x        Linux    Patch Pending
      vCenter Infrastructure Navigator   5.x        Linux    Patch Pending
      vCenter Log Insight                1.x, 2.x   Linux    2.0 U1
      vCenter Operations Manager         5.x        Linux    Patch Pending
      vCenter Orchestrator Appliance     4.x, 5.x   Linux    Patch Pending
      vCenter Site Recovery Manager      5.x        Linux    Patch Pending
**
      vCenter Support Assistant          5.x        Linux    Patch Pending
      vCloud Automation Center           6.x        Linux    Patch Pending
      vCloud Automation Center
      Application Services               6.x        Linux    Patch Pending
      vCloud Director Appliance          5.x        Linux    Patch Pending
      vCloud Connector                   2.x        Linux    Patch Pending
      vCloud Networking and Security     5.x        Linux    Patch Pending
      vCloud Usage Meter                 3.x        Linux    Patch Pending
      vFabric Application Director       5.x, 6.x   Linux    Patch Pending
      vFabric Postgres                   9.x        Linux    Patch Pending
      Viewplanner                        3.x        Linux    Patch Pending
      VMware Application Dependency 
      Planner                            x.x        Linux    Patch Pending
      VMware Data Recovery               2.x        Linux    Patch Pending
      VMware HealthAnalyzer              5.x        Linux    Patch Pending
      VMware Mirage Gateway              5.x        Linux    Patch Pending
      VMware Socialcast On Premise       x.x        Linux    Patch Pending
      VMware Studio                      2.x        Linux    Patch Pending
      VMware TAM Data Manager            x.x        Linux    Patch Pending
      VMware Workbench                   3.x        Linux    Patch Pending
      vSphere App HA                     1.x        Linux    Patch Pending
      vSphere Big Data Extensions        1.x, 2.x   Linux    Patch Pending
      vSphere Data Protection            5.x        Linux    Patch Pending
      vSphere Management Assistant       5.x        Linux    Patch Pending
      vSphere Replication                5.x        Linux    Patch Pending
      vSphere Storage Appliance          5.x        Linux    Patch Pending

     ** This product includes Virtual Appliances that will be updated, the
product 
     itself is not a Virtual Appliance.

   4. Solution

   vCenter Log Insight
   ----------------------------
   Downloads:
   https://www.vmware.com/go/download-vcenter-log-insight
   (click Go to Downloads)
   Documentation:
   http://kb.vmware.com/kb/2091065

5. References
   
   VMware Knowledge Base Article 2090740
   http://kb.vmware.com/kb/2090740

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271        , 
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187

- ------------------------------------------------------------------------

6. Change Log

   2014-09-30 VMSA-2014-0010
   Initial security advisory in conjunction with the release of
   vCenter Log Insight 2.0 U1 on 2014-09-30.

- ------------------------------------------------------------------------

 
7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

    security-announce at lists.vmware.com
    bugtraq at securityfocus.com
    fulldisclosure at seclists.org

   E-mail: security at vmware.com
   PGP key at: http://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Policy
   https://www.vmware.com/support/policies/lifecycle.html
 
   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2014 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8

wj8DBQFUK2DqDEcm8Vbi9kMRAg4rAJ9wKbbbxeD3cagCry7GGfR4fVLpDwCeMqYm
SfX/140WMvqvcmkPX2chR9s=
=1KVR
-----END PGP SIGNATURE-----

Announcing the CentOS Cloud SIG

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We are pleased to announce the formal acceptance of the CentOS Cloud
SIG by the CentOS Board.

The CentOS Cloud SIG aims to focus on building, delivering and
maintaing the software needed to run cloud infrastructure on premise.
This includes all the integration work that is needed with the
hypervisors, the storage controllers, the networking stack around it
and the user interface components. In many cases, we will rely on and
extend the work being done in the Virtualisation SIG, the Storage SIG
and other niche specific efforts as they come up in the CentOS Ecosystem.

This effort is being bootstrapped by Kushal Das, a long time open
source evangalist and cloud engineer; Helping him are Rich Bowen,
Haikel Guemar, Garrett Holmstrom, Jaime Melis, Javier Fontán and I'll
be working with the group as CentOS Board liason helping them with
infra and process requests as they come up.

Given the scope of what we are trying to achieve, we are going to need
lots of community participation, and we'd like to start by sending a
call out to the larger cloud ecosystem to come and join the effort.

The initial conversations are all going to take place on the
centos-devel mailing list (
http://lists.centos.org/mailman/listinfo/centos-devel ), please come
and join the effort.

You can read more about the Special interest group at :
http://wiki.centos.org/SpecialInterestGroup/Cloud


- -- 
Karanbir Singh, Project Lead, The CentOS Project

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)

iQEcBAEBAgAGBQJUK07TAAoJEI3Oi2Mx7xbtEd0H/iUs+f1rx1jwHBhU2/wdKZKz
447DBr0AQCcdJKDXGOZyz2/AOYO9IvC0t1+sGOTtIQNDWtRRHo7vnrHgEo9REK5L
8FddxPbCVGOxe+hm/4A2MCzpEtWL7Ep+P2JSwflUYUdwa0cBWxuFmhyNh4646p9u
mmyVeTaMFQCorffdJBb3uDb/Xxh1sPW82P74iCG07BcxQmMe5yk37MHO6uV+ZCtN
NscmundpCcykFUzY5xOez+3YtMy9e3X69/xItkYfyEFFiLId8h40hArXnCxK/2V0
hootswOF8ut2bkH6XJdnQm2DaEG3I4m/K5I5uc1mBONal622a4V+UBjcWTcQ3nY=
=oE5g
-----END PGP SIGNATURE-----

Apple Releases OS X bash Update 1.0

Original release date: September 30, 2014

Apple has released OS X bash Update 1.0 to address vulnerabilities found in the Bourne-again Shell (bash) which could allow a remote attacker to execute arbitrary shell commands.

US-CERT recommends users and administrators review Apple Security Update HT6495, TA14-268A, Vulnerability Note VU#252743 and the Redhat Security Article for additional details.


This product is provided subject to this Notification and this Privacy & Use policy.

Red Hat Security Advisory 2014-1336-01

Red Hat Security Advisory 2014-1336-01 – OpenStack Dashboard provides administrators and users a graphical interface to access, provision and automate cloud-based resources. The dashboard allows cloud administrators to get an overall view of the size and state of the cloud and it provides end-users a self-service portal to provision their own resources within the limits set by administrators. A persistent cross-site scripting flaw was found in the horizon host aggregate interface. A user with sufficient privileges to add a host aggregate could potentially use this flaw to capture the credentials of another user.

Red Hat Security Advisory 2014-1335-01

Red Hat Security Advisory 2014-1335-01 – OpenStack Dashboard provides administrators and users a graphical interface to access, provision and automate cloud-based resources. The dashboard allows cloud administrators to get an overall view of the size and state of the cloud and it provides end-users a self-service portal to provision their own resources within the limits set by administrators. A persistent cross-site scripting flaw was found in the horizon host aggregate interface. A user with sufficient privileges to add a host aggregate could potentially use this flaw to capture the credentials of another user.

Red Hat Security Advisory 2014-1340-01

Red Hat Security Advisory 2014-1340-01 – In accordance with the Red Hat Enterprise Linux Errata Support Policy, Extended Update Support for Red Hat Enterprise Linux 5.9 will be retired as of March 31, 2015, and support will no longer be provided. Accordingly, Red Hat will no longer provide updated packages, including Critical impact security patches or urgent priority bug fixes, for Red Hat Enterprise Linux 5.9 EUS after March 31, 2015. In addition, technical support through Red Hat’s Global Support Services will no longer be provided after this date. We encourage customers to plan their migration from Red Hat Enterprise Linux 5.9 to a more recent version of Red Hat Enterprise Linux. As a benefit of the Red Hat subscription model, customers can use their active subscriptions to entitle any system on any currently supported Red Hat Enterprise Linux release.