Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0505
VMware vCenter Server and vSphere Client security vulnerabilities
6 May 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: vCenter Server
vSphere Client
Publisher: VMWare
Operating System: Windows
Impact/Access: Access Confidential Data -- Remote/Unauthenticated
Increased Privileges -- Existing Account
Provide Misleading Information -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2011-1789 CVE-2011-1788 CVE-2011-0426
Original Bulletin:
http://www.vmware.com/support/support-resources/advisories/VMSA-2011-0008.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2011-0008
Synopsis: VMware vCenter Server and vSphere Client security
vulnerabilities
Issue date: 2011-05-05
Updated on: 2011-05-05 (initial release of advisory)
CVE numbers: CVE-2011-0426 CVE-2011-1788 CVE-2011-1789
- - ------------------------------------------------------------------------
1. Summary
VMware vCenter Server directory traversal and information disclosure
vulnerabilities. vSphere Client Installer is delivered through an
unsigned package.
2. Relevant releases
vCenter Server 4.1 GA
vCenter Server 4.0 Update 2 and earlier
VirtualCenter 2.5 Update 6 and earlier
ESXi 4.1 GA
ESXi 4.0 without patch ESXi400-201103402-SG
ESX 4.1 GA
ESX 4.0 without patch ESX400-201103401-SG
3. Problem Description
a. vCenter Server Directory Traversal vulnerability
A directory traversal vulnerability allows an attacker to remotely
retrieve files from vCenter Server without authentication. In order
to exploit this vulnerability, the attacker will need to have access
to the network on which the vCenter Server host resides.
In case vCenter Server is installed on Windows 2008 or
Windows 2008 R2, the security vulnerability is not present.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2011-0426 to this issue.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter 4.1 Windows Update 1 *
vCenter 4.0 Windows Update 3 *
VirtualCenter 2.5 Windows Update 6a
hosted ** any any not affected
ESXi any ESXi not affected
ESX any ESX not affected
* vCenter 4.1 and vCenter 4.0 installed on Windows 2008 or Windows
2008 R2 is not affected
** hosted products are VMware Workstation, Player, ACE, Fusion.
b. vCenter Server SOAP ID disclosure
The SOAP session ID can be retrieved by any user that is logged in
to vCenter Server. This might allow a local unprivileged user on
vCenter Server to elevate his or her privileges.
VMware would like to thank Claudio Criscione for reporting this
issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2011-1788 to this issue.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter 4.1 Windows Update 1
vCenter 4.0 Windows Update 3
VirtualCenter 2.5 Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX any ESX not affected
* hosted products are VMware Workstation, Player, ACE, Fusion.
c. vSphere Client Installer package not digitally signed
The digitally signed vSphere Client installer is packaged in a
self-extracting installer package which is not digitally signed. As
a result, when you run the install package file to extract and start
installing, the vSphere Client installer may display a Windows
warning message stating that the publisher of the install package
cannot be verified.
The vSphere Client Installer package of the following product
versions is now digitally signed:
vCenter Server 4.1 Update 1
vCenter Server 4.0 Update 3
ESXi 4.1 Update 1
ESXi 4.0 with patch ESXi400-201103402-SG
ESX 4.1 Update 1
ESX 4.0 with patch ESX400-201103401-SG
An install or update of the vSphere Client from these releases will
not present a security warning from Windows.
Note: typically the vSphere Client will request an update if the
existing client is pointed at a newer version of vCenter or ESX.
VMware Knowledge Base article 1021404 explains how the unsigned
install package can be obtained in an alternative, secure way for an
environment with VirtualCenter 2.5, ESXi/ESX 3.5 or ESX 3.0.3.
VMware would like to thank Claudio Criscione for reporting this
issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2011-1789 to this issue.
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
vCenter Server 4.1 Update 1
---------------------------
See VMSA-2011-0003 for details.
vCenter Server 4.0 Update 3
---------------------------
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vsphere_4/4_
0
Release Notes:
http://www.vmware.com/support/vsphere4/doc/vsp_vc40_u3_rel_notes.html
File type: .iso
md5sum: b04780df75f70621d0c8794e8773a983
sha1sum: a9f1398306158572ea1c3d202ed8c6ad922e0764
File type: .zip
md5sum: bc8179a639dcc6563d7dbf968095edc7
sha1sum: 61b6dbb1bcf3aa74503e183317a00733b0253faa
VMware vSphere Client
File type: .exe
md5sum: 1b90081e422358c407ad9696c70c70f7
sha1sum: 7ba9043421f8b529b0da08fa83458069ccac0fe9
VirtualCenter Server 2.5 Update 6a
----------------------------------
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_infrastructu
re_3/3_5
Release Notes:
http://downloads.vmware.com/support/vi3/doc/vi3_vc25u6_rel_notes.html
File type: .iso
md5sum: de8c246cf136b382b13be1993ca6ca3f
sha1sum: e32ec136425b3fb77afa03d8e6666a6b096debbc
File type: .zip
md5sum: 41bdc78ba9b06a1691635f1a79062f97
sha1sum: 3db04c0da053c05fab15900e127a7b20c80ee8a5
ESXi 4.0
--------
ESXi400-201103001
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-274-20110303-677
367/ESXi400-201103001.zip
md5sum: a68ef31414573460cdadef4d81fb95d0
sha1sum: 7155e60962b21b5c295a2e9412ac4a445382db31
http://kb.vmware.com/kb/1032823
ESXi400-201103001 contains ESXi400-201103402-SG
ESX 4.0
-------
ESX400-201103001
Download link:
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-273-20110303-574
144/ESX400-201103001.zip
md5sum: 5b9a0cfe6c0ff1467c09c8d115910ff8
sha1sum: 8bfb5df8066a01704eaa24e4d8a34f371816904b
http://kb.vmware.com/kb/1032822
ESX400-201103001 contains ESX400-201103401-SG
5. References
CVE numbers
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0426
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1788
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1789
VMware KB 1021404
http://kb.vmware.com/kb/1021404
VMSA-2011-0003
http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- - ------------------------------------------------------------------------
6. Change log
2011-05-05 VMSA-2011-0008
Initial security advisory in conjunction with the release of vCenter
Server 4.0 Update 3 and VirtualCenter 2.5 Update 6a on 2011-05-05.
- - ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2011 VMware Inc. All rights reserved.
- -----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8
wj8DBQFNw31BDEcm8Vbi9kMRAvScAKDf+3Uc9yeIKhc6XudZ3sS9xh6IagCdHBkM
gF5BBIBGgy5/XoMktvkfTqI=
=L+fH
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://www.auscert.org.au/1967
iD8DBQFNw5L6/iFOrG6YcBERAkzdAJ0WUWjeSDDZHGLHaqcw+khz9+4cVACeIK7x
2vTDwob3rM5pdHcxhvMABMU=
=aSSQ
-----END PGP SIGNATURE-----