Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0265.2
VMware VirtualCenter Update and ESX 3.5 patch update JRE
18 September 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: VMware VirtualCenter
Publisher: VMWare
Operating System: Windows
VMWare ESX Server
Impact/Access: Reduced Security -- Unknown/Unspecified
Resolution: Patch/Upgrade
CVE Names: CVE-2011-3561 CVE-2011-3560 CVE-2011-3558
CVE-2011-3557 CVE-2011-3556 CVE-2011-3555
CVE-2011-3554 CVE-2011-3553 CVE-2011-3552
CVE-2011-3551 CVE-2011-3550 CVE-2011-3549
CVE-2011-3548 CVE-2011-3547 CVE-2011-3546
CVE-2011-3545 CVE-2011-3544 CVE-2011-3521
CVE-2011-3516 CVE-2011-3389
Reference: ASB-2011.0092
Original Bulletin:
http://www.vmware.com/security/advisories/VMSA-2012-0003.html
Comment: Only some of the patches have been released.
Revision History: September 18 2012: Updated security advisory in conjunction with the release of vSphere 4.0 U4a on 2012-09-12 and ESX 4.0 patches
March 12 2012: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -----------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2012-0003.1
Synopsis: VMware VirtualCenter Update and ESX 3.5 patch update JRE
Issue date: 2012-03-08
Updated on: 2012-09-13
CVE numbers: See references
-----------------------------------------------------------------------
1. Summary
VMware VirtualCenter Update 6b and ESX 3.5 patch update JRE.
2. Relevant releases
VirtualCenter 2.5 previous to Update 6b
ESX 3.5 without patch ESX350-201203401-SG
3. Problem Description
a. VirtualCenter and ESX, Oracle (Sun) JRE update 1.5.0_32
Oracle (Sun) JRE is updated to version 1.5.0_32, which addresses
multiple security issues that existed in earlier releases of Oracle
(Sun) JRE.
Oracle has documented the CVE identifiers that are addressed in
JRE 1.5.0_32 in the Oracle Java SE Critical Patch Update Advisory of
October 2011.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCenter 5.0 Windows not applicable **
vCenter 4.1 Windows not applicable **
vCenter 4.0 Windows see VMSA-2012-0013
VirtualCenter 2.5 Windows VirtualCenter 2.5 Update 6b
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX not applicable **
ESX 4.0 ESX see VMSA-2012-0013
ESX 3.5 ESX ESX350-201203401-SG
* hosted products are VMware Workstation, Player, ACE, Fusion.
** this product uses the Oracle (Sun) JRE 1.6.0 family
4. Solution
VMware Virtual Center 2.5 Update 6b
-----------------------------------
Version 2.5 Update 6b
Build Number 598800
Release Date 2012/03/08
Type Product Binaries
http://www.vmware.com/download/download.do?downloadGroup=VC250U6B
vCenter Server DVD image - English only version
File type: iso
MD5SUM: 085f7bddd2adf2c4ba5bd066271e2b06
SHA1SUM: 019ff0a67d150d0a3dbdac53bfde0b0eb69f9bfd
vCenter Server as a Zip file - English only version
File type: zip
MD5SUM: ee15ae73a66dd9dbc27fada476656aeb
SHA1SUM: a5c25d114d42f1aae11d7c741587cf57caff72a3
VMware vCenter Converter BootCD for vCenter Server
File type: .zip
Version: 4.0.3
MD5SUM: e49e0ff0f2563196cc5d4b5c471cd666
VMware vCenter Converter CLI for Linux platform
File type: .tar.gz
Version: 4.0.3
MD5SUM: 30d1f5e58a6cad8dacd988908305bc1c
ESX 3.5
-------
ESX350-201203401-BG
http://downloads.vmware.com/go/selfsupport-download
md5sum: 07743c471ce46de825c36c2277ccd500
sha1sum: cb77e6f820e1015311bf2386b240fd84f0ad04dd
http://kb.vmware.com/kb/2009155
5. References
Oracle Java SE Critical Patch Update Advisory of October 2011
http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.htm
l
-----------------------------------------------------------------------
6. Change log
2012-03-08 VMSA-2012-0003
Initial security advisory in conjunction with the release of
VirtualCenter Update 6b and patches for ESX 3.5 and ESXi 3.5 on
2012-03-08.
2012-09-12 VMSA-2012-0003.1
Updated security advisory in conjunction with the release of
vSphere 4.0 U4a on 2012-09-12 and ESX 4.0 patches on 2012-09-13.
-----------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2012 VMware Inc. All rights reserved.
- -----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8
wj8DBQFQUsBaDEcm8Vbi9kMRAgLtAKCKZ50mrQ1px9KBXn/NZSd7nVIuvgCg242e
uX6pFTYgpdRleZli3532G4I=
=S/iM
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUFf1z+4yVqjM2NGpAQJQoQ/7BLZrBIRnQnfxri2c1lOHFMpO/mNnlCqK
guXiJE/eOuef4s2D5Fe/Cyqvo1JOUGMBvLrVOorH8R5RPUGYrmf+wAfoObXTId23
WgKVLOpYLnhULjjbUzn8anupN3HfwIUukIvlpwjRsiBwdLjs1dEH84TLWu3NoFrA
8lRDb2GwNgJ9F3GcMh6lX3z+7rKUSsKKKnuhc1rctJnQK6eBZ3r/fzTERFcrkG/M
Pez79W+wvvGQQ7S5EyUBiaOpmzrplyqnlZQbcy6A6DP6ku8T3nTudFGShGDc3rDp
YAoiKMXqu/jwB0tOcoG2MGpRPwfGJyXxFLeTTITPxnI0OKMfE58ItkFbzhIqgDxF
4lJfCPm6ldmNXdLsnJXDfn6Nhq6R7DCFS6HGDqntHLflFMl7SOciMuq2J+YwlBpR
osBDDW+cspr/d2FQJnsJeoe55sGc0GwnHt4APClDmOR3XKfdn040CYlHPoHwZrcY
0/qrXjJ8KmO84Vh1RlzI/ay8gSXSbze3D0mP6qaHxu2X4Lzv8hu2rB8rjq1N/Xgv
aK9vqKakUTYbJ/9MdTbeU7G4YG9JW5HHzsfnEnXnnA/5xzxmDYjDmCQYBU98ZZR9
oROUlECQIxZie7wvTkzhgqGea97ZaNiWJppzrbTFmtc3i7huKHT7zgKhTnE4IEIF
nVlvpYKmSEw=
=2LZp
-----END PGP SIGNATURE-----