Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2016.2791 VMware product updates address information disclosure vulnerabilities 23 November 2016 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: VMware vCenter Server VMware vSphere Client vRealize Automation Publisher: VMWare Operating System: Virtualisation UNIX variants (UNIX, Linux, OSX) Linux variants Impact/Access: Access Confidential Data -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2016-7460 CVE-2016-7459 CVE-2016-7458 Original Bulletin: http://www.vmware.com/security/advisories/VMSA-2016-0022.html - --------------------------BEGIN INCLUDED TEXT-------------------- VMSA-2016-0022 VMware product updates address information disclosure vulnerabilities VMware Security Advisory Advisory ID: VMSA-2016-0022 Severity: Important Synopsis: VMware product updates address information disclosure vulnerabilities Issue date: 2016-11-22 Updated on: 2016-11-22 (Initial Advisory) CVE numbers: CVE-2016-7458, CVE-2016-7459, CVE-2016-7460 1. Summary VMware vCenter Server, vSphere Client, and vRealize Automation updates address information disclosure vulnerabilities. 2. Relevant Products VMware vCenter Server VMware vSphere Client vRealize Automation 3. Problem Description a. vSphere Client XML External Entity vulnerability The vSphere Client contains an XML External Entity (XXE) vulnerability. This issue can lead to information disclosure if a vSphere Client user is tricked into connecting to a malicious instance of vCenter Server or ESXi. There are no known workarounds for this issue. VMware would like to thank Vladimir Ivanov, Andrey Evlanin, Mikhail Stepankin, Artem Kondratenko, Arseniy Sharoglazov of Positive Technologies for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7458 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.? VMware Product Product Version Running on Severity Replace with/ Apply Patch * Mitigation/ Workaround vSphere Client 6.0 Windows Important 6.0 U2a None vSphere Client 5.5 Windows Important 5.5 U3e None * In order to remediate the vulnerability, the vSphere Client will need to be uninstalled and re-installed. A fixed version of the vSphere Client can be obtained from: vCenter Server 6.0 U2a vCenter Server 5.5 U3e VMware Knowledge Base article 2089791 The build numbers of the fixed client versions may be found in VMware Knowledge Base article 2089791. b. vCenter Server XML External Entity vulnerability vCenter Server contains an XML External Entity (XXE) vulnerability in the Log Browser, the Distributed Switch setup, and the Content Library. A specially crafted XML request issued to the server by an authorized user may lead to unintended information disclosure. There are no known workarounds for this issue. VMware would like to thank Vladimir Ivanov, Andrey Evlanin, Mikhail Stepankin, Artem Kondratenko, Arseniy Sharoglazov of Positive Technologies, and Lukasz Plonka for independently for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7459 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Severity Replace with/ Apply Patch Mitigation/ Workaround vCenter Server 6.5 Any N/A Not affected N/A vCenter Server 6.0 Any Important 6.0 U2a None vCenter Server 5.5 Any Important 5.5 U3e None c. vCenter Server and vRealize Automation XML External Entity vulnerability vCenter Server and vRealize Automation contain an XML External Entity (XXE) vulnerability in the Single Sign-On functionality. A specially crafted XML request issued to the server may lead to a Denial of Service or to unintended information disclosure. There are no known workarounds for this issue. VMware would like to thank Vladimir Ivanov, Andrey Evlanin, Mikhail Stepankin, Artem Kondratenko, Arseniy Sharoglazov of Positive Technologies for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-7460 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Severity Replace with/ Apply Patch Mitigation/ Workaround vCenter Server 6.5 Any N/A Not affected N/A vCenter Server 6.0 Any Important 6.0 U2a None vCenter Server 5.5 Any Important 5.5 U3e None vRealize Automation 7.x VA N/A Not affected N/A vRealize Automation 6.x VA Important 6.2.5 None 4. Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. vCenter Server Downloads and Documentation: https://www.vmware.com/go/download-vsphere vRealize Automation Downloads and Documentation: https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_management/vmware_vrealize_automation/6_2 5. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7458 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7459 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7460 VMware Knowledge Base article 2089791 6. Change log 2016-11-22 VMSA-2016-0022 Initial security advisory in conjunction with the release of vSphere 6.0 U2a on 2016-11-22. 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce@lists.vmware.com bugtraq@securityfocus.com fulldisclosure@seclists.org E-mail: security@vmware.com PGP key at: https://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html Twitter https://twitter.com/VMwareSRC Copyright 2016 VMware Inc. All rights reserved. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWDTkWYx+lLeg9Ub1AQhJeA/9EASJkaACAk/EJTjlE3KgyErpPRi7QvuS uYYXDyHzBBO9R3j0lZvHSbcEQjQQsMe53b+qDILMeBxldzB3VJrkRqrqSeVIxzjU 10VGE8/Cyd+3Q68jR1ERJ7Pm90Efh2CAiatM1zXusy4UT+JpLQ/njMkum+lKIwTK AwZZZW6NifeLZp1/C833cRHSUUQmP0yTdYm8FAAcpjvvGk6Z38KCIoX0mLtwj8Tp dCGpiYn/Emg9zpyRgEIRxcJ0sDHwomlWbtx71ynE7MYN//8KZl1LNSo2kTNWFsnO j97nM1/q0pOi8lxzffp/SVZB1bG6guqOnhmGNmRloSY3WAqRyijdqGGNacHoybne Z2MLcQwYpEDDyJGGP7yhQQYUvuv8Bry/lqpAkuCr2/J8OcmW/3AaJSyxUbSMLaoR UtHDrOYCnVFiF/5BzTUul9Bz09beom/0fg+43FUpP+qGnsmrNObz/QvZoyxSVZiO ifk5uspiExa38SkwgsnjEf1xIEfUr+XQDMz5eBcbRd/1yvuBwCi7xfXkRpGsHFpQ /JekgYw62aif1Bd7SUEQul4+kibC6QCdHtWFgQWlSW45qZ+Kz/Dx7mtjygoTdI3x sI0j3qV3oeYQctrPbMSkVhRG5XOyZk9+mAWCOg4gzibQK1SS24aa5qgbHslfXrc0 HLgo1DiMPm0= =5utR -----END PGP SIGNATURE-----