Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0276
VMSA-2013-0003: VMware vCenter Server, ESXi and ESX address an NFC Protocol
memory corruption and third party library security issues.
25 February 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: VMware vCenter Server
VMware ESX
VMware ESXi
Publisher: VMware
Operating System: VMWare ESX Server
Linux variants
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-1659 CVE-2012-5089 CVE-2012-5088
CVE-2012-5087 CVE-2012-5086 CVE-2012-5085
CVE-2012-5084 CVE-2012-5083 CVE-2012-5082
CVE-2012-5081 CVE-2012-5080 CVE-2012-5079
CVE-2012-5078 CVE-2012-5077 CVE-2012-5076
CVE-2012-5075 CVE-2012-5074 CVE-2012-5073
CVE-2012-5072 CVE-2012-5071 CVE-2012-5070
CVE-2012-5069 CVE-2012-5068 CVE-2012-5067
CVE-2012-4416 CVE-2012-3216 CVE-2012-3159
CVE-2012-3143 CVE-2012-2110 CVE-2012-1533
CVE-2012-1532 CVE-2012-1531
Reference: ASB-2012.0144
ASB-2012.0143
ESB-2012.0388
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -----------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2013-0003
Synopsis: VMware vCenter Server, ESXi and ESX address an NFC Protocol
memory corruption and third party library security issues.
Issue date: 2013-02-21
Updated on: 2013-02-21 (initial advisory)
CVE numbers: --- vSphere NFC ---
CVE-2013-1659
--- OpenSSL ---
CVE-2012-2110
--- JRE ---
See references
- - -----------------------------------------------------------------------
1. Summary
VMware has updated VMware vCenter Server, ESXi and ESX to address
a vulnerability in the Network File Copy (NFC) Protocol. This update
also addresses multiple security vulnerabilities in third party
libraries used by VirtualCenter, ESX and ESXi.
2. Relevant releases
VMware vCenter Server 5.1 prior to 5.1.0b
VMware vCenter Server 5.0 prior to 5.0 Update 2
VMware vCenter Server 4.0 prior to Update 4b
VMware VirtualCenter 2.5 prior to Update 6c
VMware ESXi 5.1 without ESXi510-201212101-SG
VMware ESXi 5.0 without ESXi500-201212102-SG
VMware ESXi 4.1 without ESXi410-201301401-SG
VMware ESXi 4.0 without ESXi400-201302401-SG
VMware ESXi 3.5 without ESXe350-201302401-I-SG and
ESXe350-201302403-C-SG
VMware ESX 4.1 without ESX410-201301401-SG
VMware ESX 4.0 without ESX400-201302401-SG
VMware ESX 3.5 without ESX350-201302401-SG
3. Problem Description
a. VMware vCenter, ESXi and ESX NFC protocol memory corruption
vulnerability
VMware vCenter Server, ESXi and ESX contain a vulnerability in the
handling of the Network File Copy (NFC) protocol. To exploit this
vulnerability, an attacker must intercept and modify the NFC
traffic between vCenter Server and the client or ESXi/ESX and the
client. Exploitation of the issue may lead to code execution.
To reduce the likelihood of exploitation, vSphere components should
be deployed on an isolated management network
VMware would like to thank Alex Chapman of Context Information
Security for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-1659 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
vCenter Server 5.1 any vCenter Server 5.1.0b
vCenter Server 5.0 any vCenter Server 5.0 Update 2
vCenter Server 4.1 any not affected
vCenter Server 4.0 any vCenter Server 4.0 Update 4b
VirtualCenter 2.5 any not affected
hosted* any any not affected
ESXi 5.1 ESXi ESXi510-201212101-SG
ESXi 5.0 ESXi ESXi500-201212101-SG
ESXi 4.1 ESXi ESXi410-201301401-SG
ESXi 4.0 ESXi ESXi400-201302401-SG
ESXi 3.5 ESXi ESXe350-201302401-I-SG
ESX 4.1 ESX ESX410-201301401-SG
ESX 4.0 ESX ESX400-201302401-SG
ESX 3.5 ESX ESX350-201302401-SG
* hosted products are VMware Workstation, Player, ACE, Fusion.
b. VirtualCenter, ESX and ESXi Oracle (Sun) JRE update 1.5.0_38
Oracle (Sun) JRE is updated to version 1.5.0_38, which addresses
multiple security issues that existed in earlier releases of
Oracle (Sun) JRE.
Oracle has documented the CVE identifiers that are addressed
in JRE 1.5.0_38 in the Oracle Java SE Critical Patch Update
Advisory of October 2012.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
vCenter Server 5.1 any not applicable **
vCenter Server 5.0 any not applicable **
vCenter Server 4.1 any not applicable **
vCenter Server 4.0 any Patch Pending
VirtualCenter 2.5 any VirtualCenter 2.5 Update 6c
hosted* any any not affected
ESXi any ESXi not applicable
ESX 4.1 ESX not applicable **
ESX 4.0 ESX Patch Pending
ESX 3.5 ESX ESX350-201302401-SG
* hosted products are VMware Workstation, Player, Fusion.
** this product uses the Oracle (Sun) JRE 1.6.0 family
c. Update to ESX service console OpenSSL RPM
The service console OpenSSL RPM is updated to version
openssl-0.9.7a.33.28.i686 to resolve multiple security issues.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2012-2110 to this issue.
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======= ======= =================
ESXi any ESXi not applicable
ESX 4.1 ESX not applicable
ESX 4.0 ESX not applicable
ESX 3.5 ESX ESX350-201302401-SG
4. Solution
Please review the patch/release notes for your product and version
and verify the checksum of your downloaded file.
vCenter Server 5.1.0
---------------------------
Download link:
https://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_
vsphere/5_1
Release Notes:
https://www.vmware.com/support/vsphere5/doc/vsphere-vcenter-server-510b-rel
ease-notes.html
vCenter Server 5.0
---------------------------
Download link:
https://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_
vsphere/5_0
Release Notes:
https://www.vmware.com/support/vsphere5/doc/vsp_vc50_u2_rel_notes.html
vCenter Server 4.0
---------------------------
Download link:
https://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_
vsphere/4_0
Release Notes:
https://www.vmware.com/support/vsphere4/doc/vsp_vc40_u4b_rel_notes.html
VirtualCenter 2.5
---------------------------
Download link:
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_infrastructu
re_3/3_5
Release Notes:
https://www.vmware.com/support/vi3/doc/vi3_vc25u6c_rel_notes.html
ESXi and ESX
------------
https://www.vmware.com/patchmgr/download.portal
ESXi 5.1
--------
File: ESXi510-201212001.zip
md5sum: 81d562c00942973f13520afac4868748
sha1sum: ec1ff6d3e3c9b127252ba1b710c74119f1164786
http://kb.vmware.com/kb/2035775
ESXi510-201212001 contains ESXi510-201212102-SG
ESXi 5.0
------------------
File: update-from-esxi5.0-5.0_update02.zip
md5sum: ab8f7f258932a39f7d3e7877787fd198
sha1sum: b65bacab4e38cf144e223cff4770501b5bd23334
http://kb.vmware.com/kb/2033751
update-from-esxi5.0-5.0_update02 contains ESXi500-201212102-SG
ESXi 4.1
------------------
File: ESXi410-201211001.zip
md5sum: f7da5cd52d3c314abc31fe7aef4e50d3
sha1sum: a4d2232723717d896ff3b0879b0bdb3db823c0a1
http://kb.vmware.com/kb/2036257
ESXi410-201211001 contains ESXi410-201211402-BG
ESXi 4.0
------------------
File: ESXi400-201302001.zip
md5sum: 8fca17ca97669dd1d34c34902e8e7ddf
sha1sum: 51d76922eb7116810622acdd611f3029237a5680
http://kb.vmware.com/kb/2041344
ESXi400-201302001 contains ESXi400-201302402-SG
ESXi 3.5
--------
File: ESXe350-201302401-O-SG.zip
md5sum: a2c5f49bc865625b3796c41c202d1696
sha1sum: 12d25011d9940ea40d45f77a4e5bcc7e7b0c0cee
http://kb.vmware.com/kb/2042543
ESXe350-201302401-O-SG.zip contains ESXe350-201302401-I-SG and
ESXe350-201302403-C-SG
ESX 4.1
--------
File: ESX410-201211001.zip
md5sum: c167bccc388661e329fc494df13855c3
sha1sum: a8766b2eff68813a262d21a6a6ebeaae62e58c98
http://kb.vmware.com/kb/2036254
ESX410-201211001 contains ESX410-201211401-SG
ESX 4.0
--------
File: ESX400-201302001.zip
md5sum: 5ca4276e97c19b832d778e17e5f4ba64
sha1sum: 8d73cf062d8b23bd23f9b85d23f97f2888e4612f
http://kb.vmware.com/kb/2041343
ESX400-201302001 contains ESX400-201302401-SG
ESX 3.5
--------
File: ESX350-201302401-SG.zip
md5sum: e703cb0bc3e1eaa8932a96ea96f34a00
sha1sum: 91dcf1bf7194a289652d0904dd7af8bce0a1d2dd
http://kb.vmware.com/kb/2042541
5. References
--- vSphere NFC ---
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1659
--- OpenSSL ---
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110
--- JRE ---
http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.htm
l
- - -----------------------------------------------------------------------
6. Change log
2013-02-21 VMSA-2013-0003
Initial security advisory in conjunction with the release of
VirtualCenter 2.5 U6c and ESX 3.5 patches on 2013-02-21
- - -----------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2013 VMware Inc. All rights reserved.
- -----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 10.2.0 (Build 2599)
Charset: utf-8
wj8DBQFRJnbuDEcm8Vbi9kMRAvgZAJ9wTMinrcPCO81eEgcTQ2bPVRpZVgCdGttD
R1wSgAhwDPUGVJQYgXobOMA=
=YRGJ
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUSrhi+4yVqjM2NGpAQLL0g//TcPtpfbVIfuQtTsIPbIBqdzPDlcMKTH0
R2N0myfo4h7au87cv3IqkjayKkb6yK+cKTcLvJSp/2kyhuKUvpKIWIxnwrhnw+5R
NYV8HHBQs1uYNNcZ5ZQ+K0dWa1zgdZyyRjo0Uo0LQpsZczW+lcVdxJpl3nqPbmhs
quOD3uSMlo5qlBeqTSFwmnbbkJq7OtNnA0OMIPqg7MSzNIQPZ/P40nrgPhzwruIN
SWDhMgILuF32TCx9onUZRuLPxHfIDsqtqiHU4vFfpNT0KwSozDLgSKf7OsynhHRa
bYltOR0IBq2v93dAW1F4gNU9ifv5SGQb+qXbbtbp4ifxp2YfVgwJyBY3MesBJJ+Z
TbhdexOjcpxnkrpYdPiX9QXEY/aHK+P8DLgBSVyDtZHnQ90HC/+fu7WuYc7k58B5
KrN9TaYRU+6Nw8vhEWcVd4+FeYj6TY3tZcTXUHTEolNCrtMGhO982HpnzEi6k5FE
gCASxnH3jXVGcUYed6lysV4jDJEGL7PCf3byz0r4GCraZxD8AKQjReXZ3OX1Jeu8
G26Ojpjhvd0k97RN1XWPR7yEM/hU6KDYFf3LWluAiSAZlEaWT/8UGlmN388UM5w0
Xw0ki3IpNm8iEoh4/jyE56K4TS3pqwe0ghR54j4Ar0rwVqvJDcxOUEPIiZWJVZ5e
PipkvwOZRCU=
=qFls
-----END PGP SIGNATURE-----