Support Content Notification - Support Portal

VMSA-2010-0002.4

VMware vCenter update release addresses multiple security issues in Java JRE

VMware Security Advisory

VMware Security Advisory Advisory ID:

VMSA-2010-0002.4

VMware Security Advisory Synopsis:

VMware vCenter update release addresses multiple security issues in Java JRE

VMware Security Advisory Issue date:

2010-01-29

VMware Security Advisory Updated on:

2010-06-11

VMware Security Advisory CVE numbers:

--- JRE ---
CVE-2009-1093 CVE-2009-1094 CVE-2009-1095
CVE-2009-1096 CVE-2009-1097 CVE-2009-1098
CVE-2009-1099 CVE-2009-1100 CVE-2009-1101
CVE-2009-1102 CVE-2009-1103 CVE-2009-1104
CVE-2009-1105 CVE-2009-1106 CVE-2009-1107
CVE-2009-2625 CVE-2009-2670 CVE-2009-2671
CVE-2009-2672 CVE-2009-2673 CVE-2009-2675
CVE-2009-2676 CVE-2009-2716 CVE-2009-2718
CVE-2009-2719 CVE-2009-2720 CVE-2009-2721
CVE-2009-2722 CVE-2009-2723 CVE-2009-2724
CVE-2009-3728 CVE-2009-3729 CVE-2009-3864
CVE-2009-3865 CVE-2009-3866 CVE-2009-3867
CVE-2009-3868 CVE-2009-3869 CVE-2009-3871
CVE-2009-3872 CVE-2009-3873 CVE-2009-3874
CVE-2009-3875 CVE-2009-3876 CVE-2009-3877
CVE-2009-3879 CVE-2009-3880 CVE-2009-3881
CVE-2009-3882 CVE-2009-3883 CVE-2009-3884
CVE-2009-3886 CVE-2009-3885

1. Summary

Updated Java JRE packages address several security issues.

2. Relevant releases

Virtual Center 2.5 before Update 6

ESX 4.0 without patch ESX400-201005402-SG

ESX 3.5 without patch ESX350-201003403-SG

3. Problem Description

a. Java JRE Security Update
JRE update to version 1.5.0_22, which addresses multiple security issues that existed in earlier releases of JRE.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_20: CVE-2009-2625, CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676, CVE-2009-2716, CVE-2009-2718, CVE-2009-2719, CVE-2009-2720, CVE-2009-2721, CVE-2009-2722, CVE-2009-2723, CVE-2009-2724.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_22: CVE-2009-3728, CVE-2009-3729, CVE-2009-3864, CVE-2009-3865, CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882, CVE-2009-3883, CVE-2009-3884, CVE-2009-3886, CVE-2009-3885.
The following table lists what action remediates the vulnerability (column 4) if a solution is available.

VMware Product =============

Product Version =======

Running on =======

Replace with/ Apply Patch =================

VMware Product ============= vCenter

Product Version ======= 4.0

Running on ======= Windows

Replace with/ Apply Patch ================= Update 2

VMware Product ============= VirtualCenter

Product Version ======= 2.5

Running on ======= Windows

Replace with/ Apply Patch ================= Update 6

VMware Product ============= VirtualCenter

Product Version ======= 2.0.2

Running on ======= Windows

Replace with/ Apply Patch ================= affected, no patch planned

VMware Product ============= Workstation

Product Version ======= any

Running on ======= any

Replace with/ Apply Patch ================= not affected

VMware Product ============= Player

Product Version ======= any

Running on ======= any

Replace with/ Apply Patch ================= not affected

VMware Product ============= Server

Product Version ======= 2.0

Running on ======= any

Replace with/ Apply Patch ================= not being fixed at this time

VMware Product ============= Server

Product Version ======= 1.0

Running on ======= any

Replace with/ Apply Patch ================= not affected

VMware Product ============= ACE

Product Version ======= any

Running on ======= any

Replace with/ Apply Patch ================= not affected

VMware Product ============= Fusion

Product Version ======= any

Running on ======= any

Replace with/ Apply Patch ================= not affected

VMware Product ============= ESXi

Product Version ======= any

Running on ======= ESXi

Replace with/ Apply Patch ================= not affected

VMware Product ============= ESX

Product Version ======= 4.0

Running on ======= ESX

Replace with/ Apply Patch ================= ESX400-201005402-SG

VMware Product ============= ESX

Product Version ======= 3.5

Running on ======= ESX

Replace with/ Apply Patch ================= ESX350-201003403-SG

VMware Product ============= ESX

Product Version ======= 3.0.3

Running on ======= ESX

Replace with/ Apply Patch ================= affected, patch pending

VMware Product ============= ESX

Product Version ======= 2.5.5

Running on ======= ESX

Replace with/ Apply Patch ================= not affected

VMware Product ============= vMA

Product Version ======= 4.0

Running on ======= RHEL5

Replace with/ Apply Patch ================= affected, patch pending

Notes: These vulnerabilities can be exploited remotely only if the attacker has access to the Service Console network.

Security best practices provided by VMware recommend that the Service Console be isolated from the VM network. Please see http://www.vmware.com/resources/techresources/726 for more information on VMware security best practices.

The currently installed version of JRE depends on your patch deployment history.

4. Solution

Please review the patch/release notes for your product and version
and verify the sha1sum or md5sum of your downloaded file.

VMware vCenter Server 4 Update 2
--------------------------------
Version 4.0 Update 2
Build Number 264050
Release Date 2010/06/10
http://www.vmware.com/download/download.do?downloadGroup=VC40U2

VMware Virtual Center 2.5 Update 6
----------------------------------
Version 2.5 Update 6
Build Number 227637
Release Date 2010/01/29
Type Product Binaries
http://downloads.vmware.com/download/download.do?downloadGroup=VC250U6

VirtualCenter DVD image - English only version
File size: 854 MB
File type: .iso
md5sum: d83b09ac0533a418d5b7f5493dbd3ed3
sha1sum: 1b969b397a937402b5e9463efc767eff7a980ad0

VirtualCenter as a Zip file - English only version
File size: 625 MB
File type: .zip
md5sum: 760f335ebcd363e0e159b20da923621f
sha1sum: e400bc1008d1e4c44d204a8135293b8ae305f14e

VMware vCenter Converter BootCD
VMware Converter Enterprise BootCD for VirtualCenter
File size: 97 MB
File type: .zip
md5sum: e49e0ff0f2563196cc5d4b5c471cd666

VMware vCenter Converter CLI (Linux)
VMware Converter Enterprise CLI for Linux platform
File size: 37 MB
File type: .tar.gz
md5sum: 30d1f5e58a6cad8dacd988908305bc1c

ESX 4.0
-------
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-212-20100513-902204/ESX400-201005001.zip
md5sum: ace37cd8d7c6388edcea2798ba8be939
sha1sum: 8fe7312fe74a435e824d879d4f1ff33df25cee78
http://kb.vmware.com/kb/1013127

ESX 3.5
-------
ESX350-201003403-SG
http://download3.vmware.com/software/vi/ESX350-201003403-SG.zip
md5sum: cdddef476c06eeb28c10c5dac3730dca
http://kb.vmware.com/kb/1018702

5. References

6. Change log

2010-01-29 VMSA-2010-0002
Initial security advisory after release of Virtual Center 2.5 Update 6 on 2010-01-29
2010-03-29 VMSA-2010-0002.1
Updated security advisory after release of ESX 3.5 patch for WebAccess.
2010-05-27 VMSA-2010-0002.2
Updated after release of patches for ESX 4.0 on 2010-05-27.
2010-06-11 VMSA-2010-0002.3
Updated after release of vCenter Server 4.0 Update 2 on 2010-06-10.

7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk

E-mail: security at vmware.com
PGP key at:
http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html