Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2011.0305.4 VMware vCenter Orchestrator remote code execution vulnerability 28 October 2011 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: VMware vCenter Orchestrator(vCO) Publisher: VMware Operating System: Windows Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2010-1870 Original Bulletin: http://kb.vmware.com/kb/1034175 Revision History: October 28 2011: VMware vCenter Orchestrator 4.1 Update 2 released May 9 2011: VMware vCenter Orchestrator 4.0 Update 3 released April 13 2011: Initial security advisory in conjunction with the release of an Apache Struts workaround for VMware vCenter Orchestrator on 2011-03-14 March 17 2011: Initial Release - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2011-0005.3 Synopsis: VMware vCenter Orchestrator and Alive Enterprise remote code execution vulnerability Issue date: 2011-03-14 Updated on: 2011-10-27 CVE numbers: CVE-2010-1870 - - ------------------------------------------------------------------------ 1. Summary A vulnerability in VMware vCenter Orchestrator (vCO) and Alive Enterprise could allow remote execution. 2. Relevant releases VMware vCenter Orchestrator 4.1 Update 1 and earlier VMware vCenter Orchestrator 4.0 Update 2 and earlier Alive Enterprise 7.2 3. Problem Description a. Vulnerability in third party Apache Struts component VMware vCenter Orchestrator is an application to automate management tasks. Alive Enterprise is an application to monitor processes. Both products embed Apache Struts which is a third party component. The following vulnerability has been reported in Apache Struts 2.0.11 or earlier. A remote execution of code vulnerability could allow malicious users to bypass the '#'-usage protection built into the ParametersInterceptor, which could allow server side context objects to be manipulated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-1870 to this vulnerability. VMware would like to thank the Vulnerability Research Team of Digital Defense, Inc. for reporting this issue to us. Apache Struts version 2.0.11 and earlier also contain vulnerabilities which have not been assigned CVE names. This advisory also addresses these vulnerabilities described at the following URLs: * http://struts.apache.org/2.2.1/docs/s2-002.html * http://struts.apache.org/2.2.1/docs/s2-003.html * http://struts.apache.org/2.2.1/docs/s2-004.html Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= vCO 4.1 Windows Update 2 * vCO 4.0 Windows Update 3 * Alive 7.2 any affected, upgrade to vCenter Enterprise Operations Enterprise 1.0 ** vCenter any any not affected Operations Standard * With vCO 4.1 Update 2 and vCO 4.0 Update 3 the workaround in VMware Knowledge Base article 1034175 is no longer necessary. vCO is part of vCenter Server. ** Alive Enterprise has been renamed to vCenter Operations Enterprise. 4. Solution VMware vCenter Server 4.0 --------------------------- VMware vCenter Server 4.0 Update 3 The download for vCenter Server includes VMware vCenter Orchestrator. http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vsphere_4/4_0 Release Notes: http://www.vmware.com/support/vsphere4/doc/vsp_vc40_u3_rel_notes.html File type: .iso md5sum: b04780df75f70621d0c8794e8773a983 sha1sum: a9f1398306158572ea1c3d202ed8c6ad922e0764 File type: .zip md5sum: bc8179a639dcc6563d7dbf968095edc7 sha1sum: 61b6dbb1bcf3aa74503e183317a00733b0253faa VMware vSphere Client File type: .exe md5sum: 1b90081e422358c407ad9696c70c70f7 sha1sum: 7ba9043421f8b529b0da08fa83458069ccac0fe9 VMware vCenter Server 4.1 --------------------------- VMware vCenter Server 4.1 Update 2 The download for vCenter Server includes VMware vCenter Orchestrator. Download link: http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1 Release Notes: https://www.vmware.com/support/orchestrator/doc/vco_412_release_notes.html File: VMware-VIMSetup-all-4.1.0-493063.iso md5sum: d132326846a85bfc9ebbc53defeee6e1 sha1sum: 192c3e5d2a10bbe53c025cc7eedb3133a23e0541 File: VMware-VIMSetup-all-4.1.0-493063.zip md5sum: 7fd7b09e501bd8fde52649b395491222 sha1sum: 46dd00e7c594ac672a5d7c3c27d15be2f5a5f1f1 File: VMware-viclient-all-4.1.0-491557.exe md5sum: dafd31619ae66da65115ac3900697e3a sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef VMware vCenter Orchestrator --------------------------- vCenter Orchestrator workaround for Apache Struts http://kb.vmware.com/kb/1034175 VMware vCenter Operations Enterprise 1.0 --------------------------------- Download link https://www.vmware.com/downloads/download.do?downloadGroup=VCOPS-ENT-10 Release notes http://www.vmware.com/support/vcops/doc/vcops-enterprise10-release-notes.html VMware vCenter Operations Enterprise 1.0 Windows Installer (x64 bit) md5sum:a8c164c11217f05bcddd1cb87bc1d6a0 sha1sum:f4298268c75b3cc67a042401e2a2bae8c4ba7ac8 VMware vCenter Operations Enterprise 1.0 Linux Installer (x64 bit) md5sum:b82b120fa03532efb844655668383280 sha1sum:663a2fc2039a6029a97fb02995088984c0cde430 5. References CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1870 - - ------------------------------------------------------------------------ 6. Change log 2011-03-14 VMSA-2011-0005 Initial security advisory in conjunction with the release of an Apache Struts workaround for VMware vCenter Orchestrator on 2011-03-14. 2011-04-12 VMSA-2011-0005.1 Update of security advisory after the release of vCenter Operations Enterprise 1.0 on 2011-04-12. 2011-05-05 VMSA-2011-0005.2 Update of security advisory after the release of VMware vCenter Orchestrator 4.0 Update 3 on 2011-05-05. 2011-10-27 VMSA-2011-0005.3 Update of security advisory after the release of VMware vCenter Orchestrator 4.1 Update 2 on 2011-10-27. - - ------------------------------------------------------------------------ 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware security response policy http://www.vmware.com/support/policies/security_response.html General support life cycle policy http://www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html Copyright 2011 VMware Inc. All rights reserved. - -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6qQQgACgkQDEcm8Vbi9kM+egCfWuosfRa5x/R+Coxs2L1ageri BHkAn0+8l+8CkAJf8P6orF057yEp3k2F =7JQ2 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBTqpP4e4yVqjM2NGpAQK3HRAAhiHd7C9QMMQpD9dgH87Z05Mp5quoW1zd 2sfXPYKHTatn06AJOm5J2GPEMXEPPzvOegynpJ3lylA8KCatpN6EbmkX4bKX0IQH OZANPMHdtIeQV5W2FMp+dNjUwFhCrcIAxunHff37WX9XZwUZWa5cTcIqn4m/lljy StpdPnZATavVxsr9a4ipkcConKaK26nZ0srM7KZRLDLawngm+iwj/lTSDkR5UZn4 DfGYkUikBEBEz0K21kk+UBFSbdEQb0eDyYpRlLx/xnaXrKRHgHC6pc32H5MPTXx2 vPwI3PjgmKF/ubjHf9H8f03tiv1I0VuSL+7yw8p4hcEbVbs63HCKPSh0VqbywN3R ManOsbQrrE5PeWRZdZyVtAv2He0xWMHmb5p6VyQBsaB1ahBikmAZ5HLG2K3gE0Yi mpzLn/joqxHuUmtyKhQm9FQJtwQrNFe1Cq5h+z6gcM6G+v8UsCwYglDz71/I6jCU KoPJOE6NY6jWP3jRwMfGcv7ptAvLS7V2pdUxLN5QG+jtD/Pmf09rckNAbnBUWu/l wDerxVorsarUnIi5T1J71Ji17VTDyYjTtLanjbhnQkjXuQrE+KmU7ltaNZWbMrJ5 O/HTs0MLg1nQOYKvghLci3UyGDd63stqp7SyY7L3yQxNlnvoeQC/buiwZbc7+Fm8 GcrM8gF+Qw4= =g8+m -----END PGP SIGNATURE-----