Message-ID: <DA08E132-040C-4A49-BAE0-900AEC98DE87@vmware.com>
Date: Tue, 15 Mar 2016 19:19:57 +0000
From: VMware Security Response Center <security@...are.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
 "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: [FD] NEW VMSA-2016-0003 - VMware vRealize Automation and vRealize
 Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues

​-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID: VMSA-2016-0003
Synopsis:    VMware vRealize Automation and vRealize Business Advanced
             and Enterprise address Cross-Site Scripting (XSS) issues.
Issue date:  2016-03-15
Updated on:  2016-03-15 (Initial Advisory)
CVE number:  CVE-2015-2344, CVE-2016-2075

1. Summary

   VMware vRealize Automation and vRealize Business Advanced and
   Enterprise address Cross-Site Scripting (XSS) issues.
2. Relevant Releases

   VMware vRealize Automation 6.x prior to 6.2.4

   VMware vRealize Business Advanced and Enterprise 8.x prior to 8.2.5

3. Problem Description

   a. Important Stored Cross-Site Scripting (XSS) issue in VMware
   vRealize Automation

   VMware vRealize Automation contains a vulnerability that may allow
   for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this
   issue may lead to the compromise of a vRA user's client workstation.

   VMware would like to thank would like to thank Lukasz Plonka for
   reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
   assigned the identifier CVE-2015-2344 to this issue.

   Column 4 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is
   available.

   VMware                         Product    Running   Replace with/
   Product                        Version    on        Apply Patch
   =============                  =======    =======   =================
   VMware vRealize Automation     7.x        Linux     Not Affected
   VMware vRealize Automation     6.x        Linux     6.2.4
   VMware vRealize Automation     5.x        Windows   Not Affected

   b. Important Stored Cross-Site Scripting (XSS) issue in vRealize
   Business Advanced and Enterprise

   VMware vRealize Business Advanced and Enterprise contains a
   vulnerability that may allow for a Stored Cross-Site Scripting (XSS)
   attack. Exploitation of this issue may lead to the compromise of a
   vRB user's client workstation.

   VMware would like to thank Alvaro Trigo Martin de Vidales of Deloitte
   Spain for reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
   assigned the identifier CVE-2016-2075 to this issue.

   Column 4 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is
   available.

   VMware                         Product    Running   Replace with/
   Product                        Version    on        Apply Patch
   =============                  =======    =======   =================
   VMware vRealize Business       8.x        Linux     8.2.5
   Advanced and Enterprise
   VMware vRealize Business       7.x        Linux     Not Affected
   Standard
   VMware vRealize Business       6.x        Linux     Not Affected
   Standard

4. Solution

   Please review the patch/release notes for your product and
   version and verify the checksum of your downloaded file.

   VMware vRealize Automation 6.2.4
   Downloads and Doumentation:

https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage
ment/vmware_vrealize_automation/6_2

   VMware vRealize Business Advanced and Enterprise 8.2.5
   Downloads and Doumentation:

https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage
ment/vmware_vrealize_business/8_2

5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2344
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2075

- ------------------------------------------------------------------------

6. Change log

   2016-03-15 VMSA-2016-0003 Initial security advisory in conjunction
   with the release of VMware vRealize Automation 6.2.4 and VMware
   vRealize Business Advanced and Enterprise 8.2.5 on 2016-03-15.

- ------------------------------------------------------------------------

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

    security-announce at lists.vmware.com
    bugtraq at securityfocus.com
    fulldisclosure at seclists.org

   E-mail: security at vmware.com
   PGP key at: https://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   Consolidated list of VMware Security Advisories
   http://kb.vmware.com/kb/2078735

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Support Phases
   https://www.vmware.com/support/policies/lifecycle.html
   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2016 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8

wj8DBQFW6FuNDEcm8Vbi9kMRAhS5AJ47mbk6WJFefbzMQSnuagWqiYzYywCgsQtx
en095FSXbbZnPQooI7/ZdR0=
=ZE5e
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists