-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -----------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2014-0002
Synopsis: VMware vSphere updates to third party libraries
Issue date: 2014-03-11
Updated on: 2014-03-11 (initial advisory)
CVE numbers: --NTP ---
CVE-2013-5211
--glibc (service console) ---
CVE-2013-4332
--JRE--
See references
- -----------------------------------------------------------------------
1. Summary
VMware has updated vSphere third party libraries.
2. Relevant releases
vCenter Server Appliance 5.5 prior to 5.5 Update 1
VMware vCenter Server 5.5 prior 5.5 Update 1
VMware Update Manager 5.5 prior 5.5 Update 1
VMware ESXi 5.5 without patch ESXi550-201403101-SG
3. Problem Description
a. DDoS vulnerability in NTP third party libraries
The NTP daemon has a DDoS vulnerability in the handling of the
"monlist" command. An attacker may send a forged request to a
vulnerable NTP server resulting in an amplified response to the
intended target of the DDoS attack.
Mitigation
Mitigation for this issue is documented in VMware Knowledge Base
article 2070193. This article also documents when vSphere
products are affected.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-5211 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
VCSA 5.5 Linux 5.5 Update 1
VCSA 5.1 Linux patch pending
VCSA 5.0 Linux patch pending
ESXi 5.5 ESXi ESXi550-201403101-SG
ESXi 5.1 ESXi patch pending
ESXi 5.0 ESXi patch pending
ESXi 4.1 ESXi patch pending
ESXi 4.0 ESXi patch pending
ESX 4.1 ESX patch pending
ESX 4.0 ESX patch pending
b. Update to ESXi glibc package
The ESXi glibc package is updated to version
glibc-2.5-118.el5_10.2 to resolve a security issue.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-4332 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======== ======= =================
ESXi 5.5 ESXi ESXi550-201403101-SG
ESXi 5.1 ESXi patch pending
ESXi 5.0 ESXi patch pending
ESXi 4.1 ESXi no patch planned
ESXi 4.0 ESXi no patch planned
ESX 4.1 ESX not applicable
ESX 4.0 ESX not applicable
c. vCenter and Update Manager, Oracle JRE 1.7 Update 45
Oracle JRE is updated to version JRE 1.7 Update 45, which
addresses multiple security issues that existed in earlier
releases of Oracle JRE.
Oracle has documented the CVE identifiers that are addressed
in JRE 1.7.0 update 45 in the Oracle Java SE Critical Patch
Update Advisory of October 2013. The References section provides
a link to this advisory.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
vCenter Server 5.5 Any 5.5 Update 1
vCenter Server 5.1 Any not applicable **
vCenter Server 5.0 Any not applicable **
vCenter Server 4.1 Windows not applicable **
vCenter Server 4.0 Windows not applicable *
Update Manager 5.5 Windows 5.5 Update 1
Update Manager 5.1 Windows not applicable **
Update Manager 5.0 Windows not applicable **
Update Manager 4.1 Windows not applicable *
Update Manager 4.0 Windows not applicable *
ESXi any ESXi not applicable
ESX 4.1 ESX not applicable **
ESX 4.0 ESX not applicable *
* this product uses the Oracle JRE 1.5.0 family
** this product uses the Oracle JRE 1.6.0 family
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
vCenter Server 5.5
--------------------------
Download link:
https://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_
vsphere/5_5
Release Notes:
https://www.vmware.com/support/vsphere5/doc/vsphere-vcenter-server-55u1-rel
ease-notes.html
ESXi 5.5
-----------------
File: update-from-esxi5.5-5.5_update01.zip
md5sum:5773844efc7d8e43135de46801d6ea25
sha1sum:6518355d260e81b562c66c5016781db9f077161f
http://kb.vmware.com/kb/2065826
update-from-esxi5.5-5.5_update01 contains ESXi550-201403101-SG
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332
--------- jre ---------
Oracle Java SE Critical Patch Update Advisory of October 2013
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
VMware Knowledge Base article 2070193
http://kb.vmware.com/kb/2070193
- -----------------------------------------------------------------------
6. Change log
2014-03-11 VMSA-2014-0002
Initial security advisory in conjunction with the release of
vSphere 5.5 Update 1 on 2014-03-11
- -----------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
Twitter
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.0 (Build 8741)
Charset: utf-8
wj8DBQFTH88dDEcm8Vbi9kMRAk4tAKDRKjU8Cy0yRda8qaYUgMHjE2TjWACfVUKN
tROYSCy5mukUini1T520gy4=
=GT44
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Hash: SHA1
- -----------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2014-0002
Synopsis: VMware vSphere updates to third party libraries
Issue date: 2014-03-11
Updated on: 2014-03-11 (initial advisory)
CVE numbers: --NTP ---
CVE-2013-5211
--glibc (service console) ---
CVE-2013-4332
--JRE--
See references
- -----------------------------------------------------------------------
1. Summary
VMware has updated vSphere third party libraries.
2. Relevant releases
vCenter Server Appliance 5.5 prior to 5.5 Update 1
VMware vCenter Server 5.5 prior 5.5 Update 1
VMware Update Manager 5.5 prior 5.5 Update 1
VMware ESXi 5.5 without patch ESXi550-201403101-SG
3. Problem Description
a. DDoS vulnerability in NTP third party libraries
The NTP daemon has a DDoS vulnerability in the handling of the
"monlist" command. An attacker may send a forged request to a
vulnerable NTP server resulting in an amplified response to the
intended target of the DDoS attack.
Mitigation
Mitigation for this issue is documented in VMware Knowledge Base
article 2070193. This article also documents when vSphere
products are affected.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-5211 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
VCSA 5.5 Linux 5.5 Update 1
VCSA 5.1 Linux patch pending
VCSA 5.0 Linux patch pending
ESXi 5.5 ESXi ESXi550-201403101-SG
ESXi 5.1 ESXi patch pending
ESXi 5.0 ESXi patch pending
ESXi 4.1 ESXi patch pending
ESXi 4.0 ESXi patch pending
ESX 4.1 ESX patch pending
ESX 4.0 ESX patch pending
b. Update to ESXi glibc package
The ESXi glibc package is updated to version
glibc-2.5-118.el5_10.2 to resolve a security issue.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-4332 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============== ======== ======= =================
ESXi 5.5 ESXi ESXi550-201403101-SG
ESXi 5.1 ESXi patch pending
ESXi 5.0 ESXi patch pending
ESXi 4.1 ESXi no patch planned
ESXi 4.0 ESXi no patch planned
ESX 4.1 ESX not applicable
ESX 4.0 ESX not applicable
c. vCenter and Update Manager, Oracle JRE 1.7 Update 45
Oracle JRE is updated to version JRE 1.7 Update 45, which
addresses multiple security issues that existed in earlier
releases of Oracle JRE.
Oracle has documented the CVE identifiers that are addressed
in JRE 1.7.0 update 45 in the Oracle Java SE Critical Patch
Update Advisory of October 2013. The References section provides
a link to this advisory.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
vCenter Server 5.5 Any 5.5 Update 1
vCenter Server 5.1 Any not applicable **
vCenter Server 5.0 Any not applicable **
vCenter Server 4.1 Windows not applicable **
vCenter Server 4.0 Windows not applicable *
Update Manager 5.5 Windows 5.5 Update 1
Update Manager 5.1 Windows not applicable **
Update Manager 5.0 Windows not applicable **
Update Manager 4.1 Windows not applicable *
Update Manager 4.0 Windows not applicable *
ESXi any ESXi not applicable
ESX 4.1 ESX not applicable **
ESX 4.0 ESX not applicable *
* this product uses the Oracle JRE 1.5.0 family
** this product uses the Oracle JRE 1.6.0 family
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
vCenter Server 5.5
--------------------------
Download link:
https://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_
vsphere/5_5
Release Notes:
https://www.vmware.com/support/vsphere5/doc/vsphere-vcenter-server-55u1-rel
ease-notes.html
ESXi 5.5
-----------------
File: update-from-esxi5.5-5.5_update01.zip
md5sum:5773844efc7d8e43135de46801d6ea25
sha1sum:6518355d260e81b562c66c5016781db9f077161f
http://kb.vmware.com/kb/2065826
update-from-esxi5.5-5.5_update01 contains ESXi550-201403101-SG
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332
--------- jre ---------
Oracle Java SE Critical Patch Update Advisory of October 2013
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
VMware Knowledge Base article 2070193
http://kb.vmware.com/kb/2070193
- -----------------------------------------------------------------------
6. Change log
2014-03-11 VMSA-2014-0002
Initial security advisory in conjunction with the release of
vSphere 5.5 Update 1 on 2014-03-11
- -----------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.0 (Build 8741)
Charset: utf-8
wj8DBQFTH88dDEcm8Vbi9kMRAk4tAKDRKjU8Cy0yRda8qaYUgMHjE2TjWACfVUKN
tROYSCy5mukUini1T520gy4=
=GT44
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/