Support Content Notification - Support Portal

VMSA-2014-0006.11

VMware product updates address OpenSSL security vulnerabilities

VMware Security Advisory

VMware Security Advisory Advisory ID:

VMSA-2014-0006.11

VMware Security Advisory Synopsis:

VMware product updates address OpenSSL security vulnerabilities

VMware Security Advisory Issue date:

2014-06-10

VMware Security Advisory Updated on:

2014-10-09

VMware Security Advisory CVE numbers:

CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, and CVE-2014-3470

1. Summary

VMware product updates address OpenSSL security vulnerabilities.

2. Relevant Releases

Big Data Extensions prior to 2.0.0

ESXi 5.5 without patch ESXi550-201406401-SG
ESXi 5.1 without patch ESXi510-201406401-SG
ESXi 5.0 without patch ESXi500-201407401-SG

Workstation 10.x prior to 10.0.3
Workstation 9.x prior to 9.0.4

Player 6.x prior to 6.0.3
Player 5.x prior to 5.0.4

Fusion 6.x prior to 6.0.4
Fusion 5.x prior to 5.0.5

Horizon View prior to 5.3.2
Horizon View 5.3 Feature Pack X prior to Feature Pack 3

Horizon Workspace Server 1.5.x without patch horizon-nginx-rpm-1.5.0.0-1876270.x86_64.rpm
Horizon Workspace Server 1.8.x without patch horizon-nginx-rpm-1.8.2.1820-1876338.x86_64.rpm

Horizon View Clients prior to 3.0

vCD 5.5.x prior to 5.5.1.2
vCD 5.1.x prior to 5.1.3.1

vCenter prior to 5.5u1b
vCenter prior to 5.1 U2a
vCenter prior to 5.0U3a

vCenter Support Assistant prior to 5.5.1.1

vCloud Automation Center prior to 6.0.1.2

vCenter Configuration Manager prior to 5.7.2

vCenter Converter Standalone prior to 5.5.2
Converter Standalone prior to 5.1.1

Usage Manager prior to 3.3

ITBM Standard prior to 1.1

vCenter Operations Manager prior to 5.8.2
vCenter Operations Manager prior to 5.7.3

vCenter Chargeback Manager 2.6 prior to 2.6.0.1

vCloud Networking and Security prior to 5.5.2.1
vCloud Networking and Security prior to 5.1.4.1

vSphere PowerCLI 5.x

vCSA prior to 5.5u1b
vCSA prior to 5.1u2a
vCSA prior to 5.0u3a

OVF Tool prior to 5.3.2

Update Manager prior to 5.5u1b

VDDK prior to 5.5.2
VDDK prior to 5.1.3
VDDK prior to 5.0.4

NSX for Multi-Hypervisor 4.1.x prior to 4.1.3
NSX for Multi-Hypervisor 4.0.x prior to 4.0.4
NVP 3.0.x prior to 3.2.3
NSX 6.0.x for vSphere prior to 6.0.5

vFabric Web Server 5.x

Pivotal Web Server prior to 5.4.1

vCenter Site Recovery Manager prior to 5.5.1.1
vCenter Site Recovery Manager prior to 5.1.2.1
vCenter Site Recovery Manager prior to 5.0.3.2

vSphere Replication prior to 5.8
vSphere Replication prior to 5.5.1.1

vSphere SDK for Perl prior to 5.5 Update 2

vSphere Data Protection prior to 5.5.7

3. Problem Description

a. OpenSSL update for multiple products.

OpenSSL libraries have been updated in multiple products to versions 0.9.8za and 1.0.1h in order to resolve multiple security issues.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0221 and CVE-2014-0195 to these issues. The most important of these issues is CVE-2014-0224.

CVE-2014-0198, CVE-2010-5298 and CVE-2014-3470 are considered to be of moderate severity. Exploitation is highly unlikely or is mitigated due to the application configuration.

CVE-2014-0221 and CVE-2014-0195, which are listed in the OpenSSL Security Advisory (see Reference section below), do not affect any VMware products.

CVE-2014-0224 may lead to a Man-in-the-Middle attack if a server is running a vulnerable version of OpenSSL 1.0.1 and clients are running a vulnerable version of OpenSSL 0.9.8 or 1.0.1. Updating the server will mitigate this issue for both the server and all affected clients.

CVE-2014-0224 may affect products differently depending on whether the product is acting as a client or a server and of which version of OpenSSL the product is using. For readability the affected products have been split into 3 tables below, based on the different client-server configurations and deployment scenarios.

MITIGATIONS

Clients that communicate with a patched or non-vulnerable server are not vulnerable to CVE-2014-0224. Applying these patches to affected servers will mitigate the affected clients (See Table 1 below).

Clients that communicate over untrusted networks such as public Wi-Fi and communicate to a server running a vulnerable version of OpenSSL 1.0.1. can be mitigated by using a secure network such as VPN (see Table 2 below).

Clients and servers that are deployed on an isolated network are less exposed to CVE-2014-0224 (see Table 3 below). The affected products are typically deployed to communicate over the management network.

RECOMMENDATIONS

VMware recommends customers evaluate and deploy patches for affected Servers in Table 1 below as these patches become available. Patching these servers will remove the ability to exploit the vulnerability described in CVE-2014-0224 on both clients and servers.

VMware recommends customers consider applying patches to products listed in Table 2 & 3 as required.

Column 4 of the following tables lists the action required to remediate the vulnerability in each release, if a solution is available.

Table 1

Affected servers running a vulnerable version of OpenSSL 1.0.1.

VMware Product

Product Version

Running on

Replace with / Apply Patch

VMware Product ESXi

Product Version 5.5

Running on ESXi

Replace with / Apply Patch ESXi550-201406401-SG

VMware Product Big Data Extensions

Product Version 1.1

Running on

Replace with / Apply Patch 2.0.0

VMware Product vCenter Charge Back Manager

Product Version 2.6

Running on

Replace with / Apply Patch 2.6.0.1

VMware Product Horizon Workspace Server

Product Version 1.5.x

Running on

Replace with / Apply Patch horizon-nginx-rpm-1.5.0.0-1876270.x86_64.rpm

VMware Product Horizon Workspace Server

Product Version 1.8.x

Running on

Replace with / Apply Patch horizon-nginx-rpm-1.8.2.1820-1876338.x86_64.rpm

VMware Product Horizon View

Product Version 5.x

Running on

Replace with / Apply Patch 5.3.2

VMware Product Horizon View Feature Pack

Product Version 5.x

Running on

Replace with / Apply Patch 5.3 Feature Pack 3

VMware Product NSX for Multi-Hypervisor

Product Version 4.1.2

Running on

Replace with / Apply Patch 4.1.3

VMware Product NSX for Multi-Hypervisor

Product Version 4.0.3

Running on

Replace with / Apply Patch 4.0.4

VMware Product NSX for vSphere

Product Version 6.0.4

Running on

Replace with / Apply Patch 6.0.5

VMware Product NVP

Product Version 3.2.2

Running on

Replace with / Apply Patch 3.2.3

VMware Product vCloud Networking and Security

Product Version 5.5.2

Running on

Replace with / Apply Patch 5.5.2.1

VMware Product vCloud Networking and Security

Product Version 5.1.4

Running on

Replace with / Apply Patch 5.1.4.1

VMware Product Pivotal Web Server

Product Version 5.4

Running on

Replace with / Apply Patch 5.4.1

VMware Product vFabric Web Server

Product Version 5.3.4

Running on

Replace with / Apply Patch Pivotal Web Server 5.4.1

Table 2

Affected clients running a vulnerable version of OpenSSL 0.9.8 or 1.0.1 and communicating over an untrusted network.

VMware Product

Product Version

Running on

Replace with / Apply Patch

VMware Product vCSA

Product Version 5.5

Running on

Replace with / Apply Patch 5.5u1b

VMware Product vCSA

Product Version 5.1

Running on

Replace with / Apply Patch 5.1u2a

VMware Product vCSA

Product Version 5.0

Running on

Replace with / Apply Patch 5.0u3a

VMware Product ESXi

Product Version 5.1

Running on ESXi

Replace with / Apply Patch ESXi510-201406401-SG

VMware Product ESXi

Product Version 5.0

Running on ESXi

Replace with / Apply Patch ESXi500-201407401-SG

VMware Product Workstation

Product Version 10.x

Running on any

Replace with / Apply Patch 10.0.3

VMware Product Workstation

Product Version 9.x

Running on any

Replace with / Apply Patch 9.0.4

VMware Product Fusion

Product Version 6.x

Running on OSX

Replace with / Apply Patch 6.0.4

VMware Product Fusion

Product Version 5.x

Running on OSX

Replace with / Apply Patch 5.0.5

VMware Product Player

Product Version 6.x

Running on any

Replace with / Apply Patch 6.0.3

VMware Product Player

Product Version 5.x

Running on any

Replace with / Apply Patch 5.0.4

VMware Product vCenter Chargeback Manager

Product Version 2.5.x

Running on

Replace with / Apply Patch 2.6.0.1

VMware Product Horizon Workspace Client

Product Version 1.x

Running on OSX

Replace with / Apply Patch 1.8.2

VMware Product Horizon Workspace Client

Product Version 1.x

Running on Windows

Replace with / Apply Patch 1.8.2