Support Content Notification - Support Portal

VMSA-2014-0004.7

VMware product updates address OpenSSL security vulnerabilities

VMware Security Advisory

VMware Security Advisory Advisory ID:

VMSA-2014-0004.7

VMware Security Advisory Synopsis:

VMware product updates address OpenSSL security vulnerabilities

VMware Security Advisory Issue date:

2014-04-14

VMware Security Advisory Updated on:

2014-04-22

VMware Security Advisory CVE numbers:

CVE-2014-0076 and CVE-2014-0160

1. Summary

VMware product updates address OpenSSL security vulnerabilities.

2. Relevant Releases

VMware vCenter Server 5.5
VMware vCenter Server 5.5 Update 1

ESXi 5.5 without patch ESXi550-201404020
ESXi 5.5 Update 1 without patch ESXi550-201404001

VMware Workstation 10.x prior to version 10.0.2

VMware Fusion 6.x prior to version 6.0.3

VMware Player 6.x prior to version 6.0.2

NSX for Multi-Hypervisor 4.0.x prior to 4.0.2
NSX for Multi-Hypervisor 4.1.x prior to 4.1.1
NSX 6.0.x for vSphere prior to 6.0.4
NVP 3.x prior to 3.2.2

Horizon View 5.3 Feature Pack 1
Horizon View Client 2.1.x, 2.2.x and 2.3.x for Android and IOS
Horizon View Client 2.3.x for Windows

Horizon Workspace Server 1.0
Horizon Workspace Server 1.5.x without patch horizon-nginx-rpm-1.5.0.0-1736237.x86_64
Horizon Workspace Server 1.8.x prior to 1.8.1

Horizon Workspace Client 1.5.x
Horizon Workspace Client 1.8 prior to 1.8.1

OVF Tool prior to 3.5.1

VMware vCloud Networking and Security (vCNS) 5.5.1
VMware vCloud Networking and Security (vCNS) 5.1.3

vCloud Automation Center (vCAC) 6.x

vSphere Big Data Extensions 1.1

Client Integration Plug-In 5.5

vCloud Director 5.5

3. Problem Description

a. Information Disclosure vulnerability in OpenSSL third party library

The OpenSSL library is updated to version openssl-1.0.1g to resolve multiple security issues

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2014-0076 and CVE-2014-0160 to these issues.

CVE-2014-0160 is known as the Heartbleed issue. More information on this issue may be found in the reference section.

To remediate the issue for products that have updated versions or patches available, perform these steps:

Deploy the VMware product update or product patches

Replace certificates per the product-specific documentation

Reset passwords per the product-specific documentation

Section 4 lists product-specific references to installation instructions and certificate management documentation.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

Note: Products that are not affected by thses issues have been documented in VMware Knowledge Base article 2076225.

VMware Product

Product Version

Running on

Replace with / Apply Patch

VMware Product vCenter Server

Product Version 5.5

Running on any

Replace with / Apply Patch 5.5.0c

VMware Product vCenter Server

Product Version 5.5 U1

Running on any

Replace with / Apply Patch 5.5 Update 1a

VMware Product ESXi

Product Version 5.5

Running on ESXi

Replace with / Apply Patch ESXi550-201404420

VMware Product ESXi

Product Version 5.5 U1

Running on ESXi

Replace with / Apply Patch ESXi550-201404401

VMware Product Workstation

Product Version 10.x

Running on any

Replace with / Apply Patch 10.0.2 or later

VMware Product Fusion

Product Version 6.x

Running on OSX

Replace with / Apply Patch 6.0.3 or later

VMware Product Player

Product Version 6.x

Running on any

Replace with / Apply Patch 6.0.2 or later

VMware Product NSX for Multi-Hypervisor

Product Version 4.0.x

Running on

Replace with / Apply Patch 4.0.2 or later

VMware Product NSX for Multi-Hypervisor

Product Version 4.1.x

Running on

Replace with / Apply Patch 4.1.1 or later

VMware Product NSX for vSphere

Product Version 6.0.x

Running on

Replace with / Apply Patch 6.0.4 or later

VMware Product NVP

Product Version 3.x

Running on

Replace with / Apply Patch 3.2.2 or later

VMware Product Horizon View Feature Pack*

Product Version 5.3 FP 1

Running on

Replace with / Apply Patch Feature Pack 2 or later