lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <563036702.46119427.1394595049135.JavaMail.root@vmware.com>
Date: Tue, 11 Mar 2014 20:30:49 -0700 (PDT)
From: "\"VMware Security Response Center\"" <security@...are.com>
To: bugtraq@...urityfocus.com
Subject: NEW VMSA-2014-0002 VMware vSphere updates to third party libraries

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----------------------------------------------------------------------
VMware Security Advisory

Advisory ID: VMSA-2014-0002
Synopsis:    VMware vSphere updates to third party libraries 
Issue date:  2014-03-11
Updated on:  2014-03-11 (initial advisory)
CVE numbers: --NTP ---
             CVE-2013-5211
             --glibc (service console) ---
             CVE-2013-4332
             --JRE--
             See references
- -----------------------------------------------------------------------

1. Summary

   VMware has updated vSphere third party libraries.

2. Relevant releases

   vCenter Server Appliance 5.5 prior to 5.5 Update 1 

   VMware vCenter Server 5.5 prior 5.5 Update 1

   VMware Update Manager 5.5 prior 5.5 Update 1

   VMware ESXi 5.5 without patch ESXi550-201403101-SG
    
3. Problem Description

   a. DDoS vulnerability in NTP third party libraries

      The NTP daemon has a DDoS vulnerability in the handling of the
      "monlist" command. An attacker may send a forged request to a
      vulnerable NTP server resulting in an amplified response to the
      intended target of the DDoS attack. 
      
      Mitigation

      Mitigation for this issue is documented in VMware Knowledge Base
      article 2070193. This article also documents when vSphere 
      products are affected.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the name CVE-2013-5211 to this issue.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

      VMware		Product	Running	Replace with/
      Product		Version	on	Apply Patch
      =============	=======	=======	=================
      VCSA		5.5	Linux	5.5 Update 1  
      VCSA		5.1	Linux	patch pending 
      VCSA		5.0	Linux	patch pending 
      
      ESXi		5.5	ESXi	ESXi550-201403101-SG
      ESXi		5.1	ESXi	patch pending 
      ESXi		5.0	ESXi	patch pending 
      ESXi		4.1	ESXi	patch pending 
      ESXi		4.0	ESXi	patch pending 
	
      ESX		4.1	ESX	patch pending 
      ESX		4.0	ESX	patch pending 


  b. Update to ESXi glibc package

     The ESXi glibc package is updated to version
     glibc-2.5-118.el5_10.2 to resolve a security issue.

     The Common Vulnerabilities and Exposures project (cve.mitre.org)
     has assigned the name CVE-2013-4332 to this issue.

     Column 4 of the following table lists the action required to
     remediate the vulnerability in each release, if a solution is
     available.

     VMware          Product   Running  Replace with/
     Product         Version   on       Apply Patch
     ==============  ========  =======  =================
     ESXi            5.5       ESXi     ESXi550-201403101-SG
     ESXi            5.1       ESXi     patch pending
     ESXi            5.0       ESXi     patch pending 
     ESXi            4.1       ESXi     no patch planned
     ESXi            4.0       ESXi     no patch planned

     ESX             4.1       ESX      not applicable
     ESX             4.0       ESX      not applicable

  c. vCenter and Update Manager, Oracle JRE 1.7 Update 45
      
     Oracle JRE is updated to version JRE 1.7 Update 45, which
     addresses multiple security issues that existed in earlier
     releases of Oracle JRE. 

     Oracle has documented the CVE identifiers that are addressed
     in JRE 1.7.0 update 45 in the Oracle Java SE Critical Patch 
     Update Advisory of October 2013. The References section provides
     a link to this advisory.

     Column 4 of the following table lists the action required to
     remediate the vulnerability in each release, if a solution is
     available.

     VMware	      Product	Running	Replace with/
     Product	      Version	on	Apply Patch
     =============    =======	======= =================
     vCenter Server   5.5       Any     5.5 Update 1  
     vCenter Server   5.1	Any	not applicable **
     vCenter Server   5.0	Any	not applicable **
     vCenter Server   4.1	Windows	not applicable **
     vCenter Server   4.0	Windows	not applicable *

     Update Manager   5.5       Windows 5.5 Update 1 
     Update Manager   5.1	Windows	not applicable **
     Update Manager   5.0	Windows	not applicable **
     Update Manager   4.1	Windows	not applicable *
     Update Manager   4.0	Windows	not applicable *

     ESXi	      any	ESXi	not applicable

     ESX	      4.1	ESX	not applicable **
     ESX	      4.0	ESX	not applicable *
   
     * this product uses the Oracle JRE 1.5.0 family
     ** this product uses the Oracle JRE 1.6.0 family
 
4. Solution

   Please review the patch/release notes for your product and version
   and verify the checksum of your downloaded file. 
      
   vCenter Server 5.5 
   --------------------------
   Download link: 
  
https://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_
vsphere/5_5

   Release Notes: 
  
https://www.vmware.com/support/vsphere5/doc/vsphere-vcenter-server-55u1-rel
ease-notes.html

   ESXi 5.5 
   -----------------
   File: update-from-esxi5.5-5.5_update01.zip
   md5sum:5773844efc7d8e43135de46801d6ea25
   sha1sum:6518355d260e81b562c66c5016781db9f077161f
   http://kb.vmware.com/kb/2065826
   update-from-esxi5.5-5.5_update01 contains ESXi550-201403101-SG

5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332

   --------- jre --------- 
   Oracle Java SE Critical Patch Update Advisory of October 2013
  
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html

   VMware Knowledge Base article 2070193
   http://kb.vmware.com/kb/2070193 

- -----------------------------------------------------------------------

6. Change log

   2014-03-11 VMSA-2014-0002
   Initial security advisory in conjunction with the release of
   vSphere 5.5 Update 1 on 2014-03-11

- -----------------------------------------------------------------------

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

   * security-announce at lists.vmware.com
   * bugtraq at securityfocus.com
   * full-disclosure at lists.grok.org.uk

   E-mail: security at vmware.com
   PGP key at: http://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   VMware security response policy
   http://www.vmware.com/support/policies/security_response.html

   General support life cycle policy
   http://www.vmware.com/support/policies/eos.html

   Twitter
   https://twitter.com/VMwareSRC

Copyright 2014 VMware Inc.  All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.0 (Build 8741)
Charset: utf-8

wj8DBQFTH88dDEcm8Vbi9kMRAk4tAKDRKjU8Cy0yRda8qaYUgMHjE2TjWACfVUKN
tROYSCy5mukUini1T520gy4=
=GT44
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ