Security Bug In Xen May Have Exposed Amazon, Other Cloud Services
Phishing attacks ‘enough’ to breach many industrial systems
Basic phishing attacks and easily available tools are all that is needed to compromise many industrial control systems, the head of cybersecurity for the U.S. Department of Energy’s Strategic Petroleum Reserve has warned.
The post Phishing attacks ‘enough’ to breach many industrial systems appeared first on We Live Security.
Seniors are going mobile
More than three quarters (77%) of Americans aged 65 and older are now using cellphones. While they lag the general population (91%+), it is a significant increase over two years ago, according to recently released studies conducted by the Pew Research Center. Â But a much smaller group (only 18%) of this demographic has made the leap to a smartphone. The older the person, the research suggests, the less likely they have been to make the move to a smartphone.
In support of the findings, many of the seniors that I know tend to own older model cellphones that are either a) turned off, or b) not carried at all or used only under special circumstances (for travel and at insistence of family on special occasions), and c) are not used for more than actual phone calls.
But this is changing fast.
Seniors are showing a larger appetite for and are finding more value in larger format devices like tablets and e-readers. The Pew survey found 27% of seniors now own a tablet, e-reader or both (and that’s more than the public average).
Smartphone adoption should continue among seniors as new devices like the new Samsung Galaxy, Amazon Fire and Apple iPhone 6 continue to get larger and become easier to read and manipulate. In fact, the researchers at Deloitte predict that people 55+ Â (that would include Boomers through seniors) will experience the fastest growth in smartphone adoption in 2014, with 45-50% predicted to own a smartphone by the end of 2014.
Financial considerations for many seniors (especially those on fixed incomes) and confusion about career plans have no doubt led to a lag in smartphone adoption. But needing assistance to learn how to use the new devices and associated apps is one of the largest concerns by seniors (77%) in adopting smartphone technology, according to Pew.
This should be a concern to us in the technology industry. Shouldn’t we be making technology that is inherently simple to adopt? Shouldn’t we be designing apps for that –and, more specifically, with seniors in mind?
AARP thinks so. The organization just introduced a new tablet the RealPad aimed at this market. (I’ll cover this in more detail in my next column.)
During the recent national AARP event in San Diego, where AVG participated, we were concerned to learn that about one-third of the seniors we spoke to admitted that they use no security software on their smartphone or tablet devices. That suggests there is a lot of work to be done to help educate this audience on how to stay safe online.
Security of data is a primary issue when dealing with a smartphone or any smart connected devices – whether it involves sharing photos on social media, emailing or banking. Once online, Pew and others have found that the senior demographic is rapidly embracing social media (46%). In the brief survey of those who stopped by our booth on technology usage (we’ll share more details on this later), email was the most popular online application for the group, followed by banking.
Here are some simple tips for smartphone users to make data safer – applicable to everyone:
- Screen lock the phone. Setting your smartphone to require a PIN code or password for access after an inactive period is a relatively easy way to keep your data safe.
- Apply operating system updates. Often when our device prompts us to install an update, many of us simply ignore it. We shouldn’t. Many updates carry security-related improvements so update whenever you can.
- Think twice before connecting your smartphone to a public Wi-Fi hotspot, because just as with a PC, this kind of shared, unsecured connection can leave activity and data vulnerable to eavesdropping and theft.
- Beware of text message spam. Just like a web page or an email, text messages can be used for mischief. Especially if your device doesn’t have security software, links hidden in text messages can lead to malicious sites, unwanted apps and sometimes even expensive phone bills.
- Which brings us back to security software! Â Use it! Malware writers see the vast mobile market as a great opportunity to make some quick profit. In a world where your smartphones probably carries more of your sensitive personal information that your home PC, it’s a good idea to use some basic protection.
I am very excited that more seniors are embracing smartphones and tablets. Â They are great tools to keep connected with family and friends, be active and engaged. Â Now, we in the tech industry must catch up with them and provide the tools to make it more useful and enjoyable!
People are willing to trade private data for pistachio cookies
Many New Yorkers don’t place a particularly high value on their private data – from fingerprints to social security numbers – having proven willing to give away such details in return for a literal, edible cookies.
The post People are willing to trade private data for pistachio cookies appeared first on We Live Security.
UPDATED VMSA-2014-0010.2 – VMware product updates address critical Bash security vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2014-0010.2
Synopsis: VMware product updates address critical Bash
security vulnerabilities
Issue date: 2014-09-30
Updated on: 2014-10-01
CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186,
CVE-2014-7187, CVE-2014-6277, CVE-2014-6278
- ------------------------------------------------------------------------
1. Summary
VMware product updates address Bash security vulnerabilities.
2. Relevant Releases (Affected products for which remediation is present)
ESX 4.1 without patch ESX410-201410401-SG
ESX 4.0 without patch ESX400-201410401-SG
vCenter Server Appliance prior to 5.5 U2a
vCenter Server Appliance prior to 5.1 U2b
vCenter Server Appliance prior to 5.0 U3b
Horizon Workspace 1.x, 2.x without patch
IT Business Management Suite prior to 1.1.0
IT Business Management Suite prior to 1.0.1
vCenter Log Insight prior to 2.0U1
vCenter Operations Manager 5.x without patch
vCenter Site Recovery Manager prior to 5.5.1.3
vCenter Site Recovery Manager prior to 5.1.2.2
vCloud Application Director 5.x, 6.x without patch
vCloud Automation Center 6.x without patch
vCloud Automation Center Application Services 6.x without patch
vCloud Director Appliance prior to 5.5.1.3
vFabric Postgres prior to 9.3.5.1
vFabric Postgres prior to 9.2.9.1
vFabric Postgres prior to 9.1.14.1
VMware Data Recovery prior to 2.0.4
VMware Mirage Gateway prior to 5.1.1
vSphere Replication prior to 5.8.0.1
vSphere Replication prior to 5.5.1.3
vSphere Replication prior to 5.1.2.2
vSphere Storage Appliance prior to 5.5.2
3. Problem Description
a. Bash update for multiple products.
Bash libraries have been updated in multiple products to resolve
multiple critical security issues, also referred to as Shellshock.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifiers CVE-2014-6271, CVE-2014-7169,
CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278
to these issues.
VMware products have been grouped into the following four
product categories:
I) ESXi and ESX Hypervisor
ESXi is not affected because ESXi uses the Ash shell (through
busybox), which is not affected by the vulnerability reported
for the Bash shell.
ESX has an affected version of the Bash shell. See table 1 for
remediation for ESX.
II) Windows-based products
Windows-based products, including all versions of vCenter Server
running on Windows, are not affected.
III) VMware (virtual) appliances
VMware (virtual) appliances ship with an affected version of Bash.
See table 2 for remediation for appliances.
IV) Products that run on Linux, Android, OSX or iOS (excluding
virtual appliances)
Products that run on Linux, Android, OSX or iOS (excluding
virtual appliances) might use the Bash shell that is part of the
operating system. If the operating system has a vulnerable
version of Bash, the Bash security vulnerability might be
exploited through the product. VMware recommends that customers
contact their operating system vendor for a patch.
MITIGATIONS
VMware encourages restricting access to appliances through
firewall rules and other network layer controls to only trusted IP
addresses. This measure will greatly reduce any risk to these
appliances.
RECOMMENDATIONS
VMware recommends customers evaluate and deploy patches for
affected products in Table 1 and 2 below as these
patches become available.
Column 4 of the following tables lists the action required to
remediate the vulnerability in each release, if a solution is
available.
Table 1 - ESXi and ESX Hypervisor
=================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= =============
ESXi any ESXi Not affected
ESX 4.1 ESX ESX410-201410401-SG*
ESX 4.0 ESX ESX400-201410401-SG*
* VMware has made VMware ESX 4.0 and 4.1 security patches available
for the Bash shell vulnerability. This security patch release is an
exception to the existing VMware lifecycle policy.
Table 2 - Products that are shipped as a (virtual) appliance.
=============================================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= ================
vCenter Server Appliance 5.x Linux 5.5 U2a, 5.1 U2b,
5.0 U3b
Horizon DaaS Platform 6.x Linux Patch Pending
Horizon Workspace 1.x, 2.x Linux See Section 4
IT Business Management Suite 1.x Linux 1.1.0, 1.0.1
NSX for Multi-Hypervisor 4.x Linux Patch Pending
NSX for vSphere 6.x Linux Patch Pending
NVP 3.x Linux Patch Pending
vCenter Converter Standalone 5.x Linux Patch Pending**
vCenter Hyperic Server 5.x Linux Patch Pending
vCenter Infrastructure Navigator 5.x Linux Patch Pending
vCenter Log Insight 1.x, 2.x Linux 2.0 U1
vCenter Operations Manager 5.x Linux See Section 4
vCenter Orchestrator Appliance 4.x, 5.x Linux Patch Pending
vCenter Site Recovery Manager 5.x Linux 5.5.1.3, 5.1.2.2,
5.0.x**
vCenter Support Assistant 5.x Linux Patch Pending
vCloud Application Director 5.x, 6.x Linux See Section 4
vCloud Automation Center 6.x Linux See Section 4
vCloud Automation Center
Application Services 6.x Linux See Section 4
vCloud Director Appliance 5.x Linux 5.5.1.3
vCloud Connector 2.x Linux Patch Pending
vCloud Networking and Security 5.x Linux Patch Pending
vCloud Usage Meter 3.x Linux Patch Pending
vFabric Postgres 9.x Linux 9.3.5.1, 9.2.9.1,
9.1.14.1
Viewplanner 3.x Linux Patch Pending
VMware Application Dependency
Planner x.x Linux Patch Pending
VMware Data Recovery 2.x Linux 2.0.4
VMware HealthAnalyzer 5.x Linux Patch Pending
VMware Mirage Gateway 5.x Linux 5.1.1
VMware Socialcast On Premise x.x Linux Patch Pending
VMware Studio 2.x Linux Patch Pending
VMware TAM Data Manager x.x Linux Patch Pending
VMware Workbench 3.x Linux Patch Pending
vSphere App HA 1.x Linux Patch Pending
vSphere Big Data Extensions 1.x, 2.x Linux Patch Pending
vSphere Data Protection 5.x Linux Patch Pending
vSphere Management Assistant 5.x Linux Patch Pending
vSphere Replication 5.x Linux 5.8.0.1, 5.5.1.3,
5.1.2.2
vSphere Storage Appliance 5.x Linux 5.5.2
** This product includes Virtual Appliances that will be updated, the
product
itself is not a Virtual Appliance.
4. Solution
ESX
---
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2090859
http://kb.vmware.com/kb/2090853
vCenter Server Appliance
------------------------
Downloads:
https://my.vmware.com/web/vmware/details?productId=353&downloadGroup=VC55U2
(scroll down to 5.5 Update 2a Appliance)
https://my.vmware.com/web/vmware/details?productId=285&downloadGroup=VCL-VS
P510-VC-51U2A
(scroll down to 5.1 Update 2b Appliance)
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VC50U3
A
(scroll down to 5.0 Update 3b Appliance)
Documentation:
http://kb.vmware.com/kb/2091085
http://kb.vmware.com/kb/2091018
http://kb.vmware.com/kb/2091017
Horizon Workspace
-------------------------
Downloads:
(Scroll down to the relevant download)
Workspace Portal 2.1.0 ->
https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGr
oup=HZNP210
Workspace Portal 2.0.0 ->
https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGr
oup=HZNWS200
Horizon Workspace 1.8.2 ->
https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr
oup=HZNWS182
Horizon Workspace 1.8.1 ->
https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr
oup=HZNWS181
Horizon Workspace 1.8.0 ->
https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr
oup=HZNWS180
Horizon Workspace 1.5.2 ->
https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr
oup=HZNWS152
Horizon Workspace 1.5.1 ->
https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr
oup=HZNWS151
Horizon Workspace 1.5.0 ->
https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr
oup=HZNWS150
Documentation:
http://kb.vmware.com/kb/2091067
IT Business Management Suite
-------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-110&product
Id=384&rPId=6384
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-101&product
Id=385&rPId=6333
Documentation:
http://kb.vmware.com/kb/2091014
http://kb.vmware.com/kb/2091013
vCenter Log Insight
-------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=STRATA20&productId=4
12&rPId=5804
Documentation:
http://kb.vmware.com/kb/2091065
vCenter Operations Manager
--------------------------
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCOPS-583-STD
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCOPS-573-STD
Documentation:
http://kb.vmware.com/kb/2091083
http://kb.vmware.com/kb/2091002
vCenter Site Recovery Manager
-----------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5513&productId=35
7&rPId=6636
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5122&productId=29
1&rPId=6631
Documentation:
http://kb.vmware.com/kb/2091038
http://kb.vmware.com/kb/2091039
http://kb.vmware.com/kb/2091037 (5.0.x)
vCloud Application Director
---------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPDIR_601_GA&produc
tId=383&rPId=6216
https://my.vmware.com/web/vmware/details?downloadGroup=VFAPPDIR_520_GA&prod
uctId=345&rPId=3789
Documentation:
http://kb.vmware.com/kb/2091129
vCloud Automation Center
------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-610&productId=4
47&rPId=6501
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-6012&productId=
383&rPId=6216
Documentation:
http://kb.vmware.com/kb/2091012
vCloud Automation Center Application Services
---------------------------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPSER_610&productId
=447&rPId=6501
Documentation:
http://kb.vmware.com/kb/2091129
vCloud Director Appliance
-------------------------
Downloads:
www.vmware.com/go/try-vcloud-director
Documentation:
http://kb.vmware.com/kb/2091071
vFabric Postgres
----------------
Downloads:
https://my.vmware.com/web/vmware/info/slug/application_platform/vmware_vfab
ric_postgres/9_3
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfab
ric_postgres/9_2
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfab
ric_postgres/9_1
Documentation:
http://kb.vmware.com/kb/2091055
VMware Data Recovery
--------------------
Downloads:
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VDR204
Documentation:
http://kb.vmware.com/kb/2091015
VMware Mirage Gateway
---------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=MIRAGE-510&productId
=407&rPId=6565
(See VMware Mirage Gateway Software)
Documentation:
http://kb.vmware.com/kb/2091090
vSphere Replication
-------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VR5801&productId=353
&rPId=6654
https://my.vmware.com/web/vmware/details?productId=353&rPId=5721&downloadGr
oup=VR5513
https://my.vmware.com/web/vmware/details?downloadGroup=VR5122&productId=285
&rPId=6779
Documentation:
http://kb.vmware.com/kb/2091019
http://kb.vmware.com/kb/2091033
http://kb.vmware.com/kb/2091035
vSphere Storage Appliance
-------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP55-VSA-552&produc
tId=354&rPId=6585
Documentation:
http://kb.vmware.com/kb/2091000
5. References
VMware Knowledge Base Article 2090740
http://kb.vmware.com/kb/2090740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 ,
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
- ------------------------------------------------------------------------
6. Change Log
2014-09-30 VMSA-2014-0010
Initial security advisory in conjunction with the release of
vCenter Log Insight 2.0 U1 on 2014-09-30.
2014-10-01 VMSA-2014-0010.1
Updated advisory in conjunction with the release of ESX 4.x patches,
vCenter Server Appliance 5.5 U2a, 5.1 U2b, and 5.0 U3b, vCloud Director
Appliance 5.5.1.3, VMware Data Recovery 2.0.4, VMware Mirage Gateway
5.1.1 and vSphere Storage Appliance 5.5.2 on 2014-10-01. Added
CVE-2014-6277 and CVE-2014-6278 as they have been confirmed to be
mitigated.
2014-10-01 VMSA-2014-0010.2
Updated advisory in conjunction with the release of Horizon Workspace
patches, IT Business Management Suite 1.1.0 and 1.0.1, vCenter
Operations Manager patches, vCenter Site Recovery Manager 5.5.1.3 and
5.1.2.2, vCloud Application Director patches, vCloud Automation Center
patches, vCloud Automation Center Application Services patches, vCloud
Director Appliance 5.5.1.3, vFabric Postgres 9.3.5.1, 9.2.9.1, and
9.1.14.1, vSphere Replication 5.8.0.1, 5.5.1.3, and 5.1.2.2 on
2014-10-01.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Policy
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8
wj8DBQFULM96DEcm8Vbi9kMRAlcPAJ0bXoybnDZKuYJXVDjQr81ay+5W+gCfWAfa
Vjt9CUQxcJ0aEPQ1yC6gE/Y=
=fjxQ
-----END PGP SIGNATURE-----
UPDATED VMSA-2014-0010.2 – VMware product updates address critical Bash security vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
VMware Security Advisory
Advisory ID: VMSA-2014-0010.2
Synopsis: VMware product updates address critical Bash
security vulnerabilities
Issue date: 2014-09-30
Updated on: 2014-10-01
CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186,
CVE-2014-7187, CVE-2014-6277, CVE-2014-6278
- ------------------------------------------------------------------------
1. Summary
VMware product updates address Bash security vulnerabilities.
2. Relevant Releases (Affected products for which remediation is present)
ESX 4.1 without patch ESX410-201410401-SG
ESX 4.0 without patch ESX400-201410401-SG
vCenter Server Appliance prior to 5.5 U2a
vCenter Server Appliance prior to 5.1 U2b
vCenter Server Appliance prior to 5.0 U3b
Horizon Workspace 1.x, 2.x without patch
IT Business Management Suite prior to 1.1.0
IT Business Management Suite prior to 1.0.1
vCenter Log Insight prior to 2.0U1
vCenter Operations Manager 5.x without patch
vCenter Site Recovery Manager prior to 5.5.1.3
vCenter Site Recovery Manager prior to 5.1.2.2
vCloud Application Director 5.x, 6.x without patch
vCloud Automation Center 6.x without patch
vCloud Automation Center Application Services 6.x without patch
vCloud Director Appliance prior to 5.5.1.3
vFabric Postgres prior to 9.3.5.1
vFabric Postgres prior to 9.2.9.1
vFabric Postgres prior to 9.1.14.1
VMware Data Recovery prior to 2.0.4
VMware Mirage Gateway prior to 5.1.1
vSphere Replication prior to 5.8.0.1
vSphere Replication prior to 5.5.1.3
vSphere Replication prior to 5.1.2.2
vSphere Storage Appliance prior to 5.5.2
3. Problem Description
a. Bash update for multiple products.
Bash libraries have been updated in multiple products to resolve
multiple critical security issues, also referred to as Shellshock.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifiers CVE-2014-6271, CVE-2014-7169,
CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278
to these issues.
VMware products have been grouped into the following four
product categories:
I) ESXi and ESX Hypervisor
ESXi is not affected because ESXi uses the Ash shell (through
busybox), which is not affected by the vulnerability reported
for the Bash shell.
ESX has an affected version of the Bash shell. See table 1 for
remediation for ESX.
II) Windows-based products
Windows-based products, including all versions of vCenter Server
running on Windows, are not affected.
III) VMware (virtual) appliances
VMware (virtual) appliances ship with an affected version of Bash.
See table 2 for remediation for appliances.
IV) Products that run on Linux, Android, OSX or iOS (excluding
virtual appliances)
Products that run on Linux, Android, OSX or iOS (excluding
virtual appliances) might use the Bash shell that is part of the
operating system. If the operating system has a vulnerable
version of Bash, the Bash security vulnerability might be
exploited through the product. VMware recommends that customers
contact their operating system vendor for a patch.
MITIGATIONS
VMware encourages restricting access to appliances through
firewall rules and other network layer controls to only trusted IP
addresses. This measure will greatly reduce any risk to these
appliances.
RECOMMENDATIONS
VMware recommends customers evaluate and deploy patches for
affected products in Table 1 and 2 below as these
patches become available.
Column 4 of the following tables lists the action required to
remediate the vulnerability in each release, if a solution is
available.
Table 1 - ESXi and ESX Hypervisor
=================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= =============
ESXi any ESXi Not affected
ESX 4.1 ESX ESX410-201410401-SG*
ESX 4.0 ESX ESX400-201410401-SG*
* VMware has made VMware ESX 4.0 and 4.1 security patches available
for the Bash shell vulnerability. This security patch release is an
exception to the existing VMware lifecycle policy.
Table 2 - Products that are shipped as a (virtual) appliance.
=============================================================
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======= ======= ================
vCenter Server Appliance 5.x Linux 5.5 U2a, 5.1 U2b,
5.0 U3b
Horizon DaaS Platform 6.x Linux Patch Pending
Horizon Workspace 1.x, 2.x Linux See Section 4
IT Business Management Suite 1.x Linux 1.1.0, 1.0.1
NSX for Multi-Hypervisor 4.x Linux Patch Pending
NSX for vSphere 6.x Linux Patch Pending
NVP 3.x Linux Patch Pending
vCenter Converter Standalone 5.x Linux Patch Pending**
vCenter Hyperic Server 5.x Linux Patch Pending
vCenter Infrastructure Navigator 5.x Linux Patch Pending
vCenter Log Insight 1.x, 2.x Linux 2.0 U1
vCenter Operations Manager 5.x Linux See Section 4
vCenter Orchestrator Appliance 4.x, 5.x Linux Patch Pending
vCenter Site Recovery Manager 5.x Linux 5.5.1.3, 5.1.2.2,
5.0.x**
vCenter Support Assistant 5.x Linux Patch Pending
vCloud Application Director 5.x, 6.x Linux See Section 4
vCloud Automation Center 6.x Linux See Section 4
vCloud Automation Center
Application Services 6.x Linux See Section 4
vCloud Director Appliance 5.x Linux 5.5.1.3
vCloud Connector 2.x Linux Patch Pending
vCloud Networking and Security 5.x Linux Patch Pending
vCloud Usage Meter 3.x Linux Patch Pending
vFabric Postgres 9.x Linux 9.3.5.1, 9.2.9.1,
9.1.14.1
Viewplanner 3.x Linux Patch Pending
VMware Application Dependency
Planner x.x Linux Patch Pending
VMware Data Recovery 2.x Linux 2.0.4
VMware HealthAnalyzer 5.x Linux Patch Pending
VMware Mirage Gateway 5.x Linux 5.1.1
VMware Socialcast On Premise x.x Linux Patch Pending
VMware Studio 2.x Linux Patch Pending
VMware TAM Data Manager x.x Linux Patch Pending
VMware Workbench 3.x Linux Patch Pending
vSphere App HA 1.x Linux Patch Pending
vSphere Big Data Extensions 1.x, 2.x Linux Patch Pending
vSphere Data Protection 5.x Linux Patch Pending
vSphere Management Assistant 5.x Linux Patch Pending
vSphere Replication 5.x Linux 5.8.0.1, 5.5.1.3,
5.1.2.2
vSphere Storage Appliance 5.x Linux 5.5.2
** This product includes Virtual Appliances that will be updated, the
product
itself is not a Virtual Appliance.
4. Solution
ESX
---
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2090859
http://kb.vmware.com/kb/2090853
vCenter Server Appliance
------------------------
Downloads:
https://my.vmware.com/web/vmware/details?productId=353&downloadGroup=VC55U2
(scroll down to 5.5 Update 2a Appliance)
https://my.vmware.com/web/vmware/details?productId=285&downloadGroup=VCL-VS
P510-VC-51U2A
(scroll down to 5.1 Update 2b Appliance)
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VC50U3
A
(scroll down to 5.0 Update 3b Appliance)
Documentation:
http://kb.vmware.com/kb/2091085
http://kb.vmware.com/kb/2091018
http://kb.vmware.com/kb/2091017
Horizon Workspace
-------------------------
Downloads:
(Scroll down to the relevant download)
Workspace Portal 2.1.0 ->
https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGr
oup=HZNP210
Workspace Portal 2.0.0 ->
https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGr
oup=HZNWS200
Horizon Workspace 1.8.2 ->
https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr
oup=HZNWS182
Horizon Workspace 1.8.1 ->
https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr
oup=HZNWS181
Horizon Workspace 1.8.0 ->
https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGr
oup=HZNWS180
Horizon Workspace 1.5.2 ->
https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr
oup=HZNWS152
Horizon Workspace 1.5.1 ->
https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr
oup=HZNWS151
Horizon Workspace 1.5.0 ->
https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGr
oup=HZNWS150
Documentation:
http://kb.vmware.com/kb/2091067
IT Business Management Suite
-------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-110&product
Id=384&rPId=6384
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-101&product
Id=385&rPId=6333
Documentation:
http://kb.vmware.com/kb/2091014
http://kb.vmware.com/kb/2091013
vCenter Log Insight
-------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=STRATA20&productId=4
12&rPId=5804
Documentation:
http://kb.vmware.com/kb/2091065
vCenter Operations Manager
--------------------------
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCOPS-583-STD
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCOPS-573-STD
Documentation:
http://kb.vmware.com/kb/2091083
http://kb.vmware.com/kb/2091002
vCenter Site Recovery Manager
-----------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5513&productId=35
7&rPId=6636
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5122&productId=29
1&rPId=6631
Documentation:
http://kb.vmware.com/kb/2091038
http://kb.vmware.com/kb/2091039
http://kb.vmware.com/kb/2091037 (5.0.x)
vCloud Application Director
---------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPDIR_601_GA&produc
tId=383&rPId=6216
https://my.vmware.com/web/vmware/details?downloadGroup=VFAPPDIR_520_GA&prod
uctId=345&rPId=3789
Documentation:
http://kb.vmware.com/kb/2091129
vCloud Automation Center
------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-610&productId=4
47&rPId=6501
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-6012&productId=
383&rPId=6216
Documentation:
http://kb.vmware.com/kb/2091012
vCloud Automation Center Application Services
---------------------------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPSER_610&productId
=447&rPId=6501
Documentation:
http://kb.vmware.com/kb/2091129
vCloud Director Appliance
-------------------------
Downloads:
www.vmware.com/go/try-vcloud-director
Documentation:
http://kb.vmware.com/kb/2091071
vFabric Postgres
----------------
Downloads:
https://my.vmware.com/web/vmware/info/slug/application_platform/vmware_vfab
ric_postgres/9_3
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfab
ric_postgres/9_2
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfab
ric_postgres/9_1
Documentation:
http://kb.vmware.com/kb/2091055
VMware Data Recovery
--------------------
Downloads:
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VDR204
Documentation:
http://kb.vmware.com/kb/2091015
VMware Mirage Gateway
---------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=MIRAGE-510&productId
=407&rPId=6565
(See VMware Mirage Gateway Software)
Documentation:
http://kb.vmware.com/kb/2091090
vSphere Replication
-------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VR5801&productId=353
&rPId=6654
https://my.vmware.com/web/vmware/details?productId=353&rPId=5721&downloadGr
oup=VR5513
https://my.vmware.com/web/vmware/details?downloadGroup=VR5122&productId=285
&rPId=6779
Documentation:
http://kb.vmware.com/kb/2091019
http://kb.vmware.com/kb/2091033
http://kb.vmware.com/kb/2091035
vSphere Storage Appliance
-------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP55-VSA-552&produc
tId=354&rPId=6585
Documentation:
http://kb.vmware.com/kb/2091000
5. References
VMware Knowledge Base Article 2090740
http://kb.vmware.com/kb/2090740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 ,
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
- ------------------------------------------------------------------------
6. Change Log
2014-09-30 VMSA-2014-0010
Initial security advisory in conjunction with the release of
vCenter Log Insight 2.0 U1 on 2014-09-30.
2014-10-01 VMSA-2014-0010.1
Updated advisory in conjunction with the release of ESX 4.x patches,
vCenter Server Appliance 5.5 U2a, 5.1 U2b, and 5.0 U3b, vCloud Director
Appliance 5.5.1.3, VMware Data Recovery 2.0.4, VMware Mirage Gateway
5.1.1 and vSphere Storage Appliance 5.5.2 on 2014-10-01. Added
CVE-2014-6277 and CVE-2014-6278 as they have been confirmed to be
mitigated.
2014-10-01 VMSA-2014-0010.2
Updated advisory in conjunction with the release of Horizon Workspace
patches, IT Business Management Suite 1.1.0 and 1.0.1, vCenter
Operations Manager patches, vCenter Site Recovery Manager 5.5.1.3 and
5.1.2.2, vCloud Application Director patches, vCloud Automation Center
patches, vCloud Automation Center Application Services patches, vCloud
Director Appliance 5.5.1.3, vFabric Postgres 9.3.5.1, 9.2.9.1, and
9.1.14.1, vSphere Replication 5.8.0.1, 5.5.1.3, and 5.1.2.2 on
2014-10-01.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Policy
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8
wj8DBQFULM96DEcm8Vbi9kMRAlcPAJ0bXoybnDZKuYJXVDjQr81ay+5W+gCfWAfa
Vjt9CUQxcJ0aEPQ1yC6gE/Y=
=fjxQ
-----END PGP SIGNATURE-----
MS14-030 – Important: Vulnerability in Remote Desktop Could Allow Tampering (2969259) – Version: 1.3
Severity Rating: Important
Revision Note: V1.3 (October 2, 2014): Bulletin revised to clarify the conditions under which Windows 7 editions are affected. See the Update FAQ for more information.
Summary: This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow tampering if an attacker gains access to the same network segment as the targeted system during an active RDP session, and then sends specially crafted RDP packets to the targeted system.
PHPCompta/NOALYSS 6.7.1 5638 Remote Command Execution
PHPCompta/NOALYSS version 6.7.1 5638 suffers from a remote command execution vulnerability.
WordPress Content Audit 1.6 Blind SQL Injection
WordPress Content Audit plugin version 1.6 suffers from a remote SQL injection vulnerability.