VMSA-2014-0002.4

VMware vSphere updates to third party libraries

1. Summary

VMware has updated vSphere third party libraries.

2. Relevant Releases

vCenter Server Appliance 5.5 prior to 5.5 Update 1
vCenter Server Appliance 5.1 prior to 5.1 Update 3

VMware vCenter Server 5.5 prior 5.5 Update 1

VMware Update Manager 5.5 prior 5.5 Update 1

VMware ESXi 5.5 without patch ESXi550-201403101-SG
VMware ESXi 5.1 without patch ESXi510-201404101-SG
VMware ESXi 5.0 without patch ESXi500-201405101-SG
VMware ESXi 4.1 without patch ESXi410-201404401-SG
VMware ESXi 4.0 without patch ESXi400-201404401-SG
   
VMware ESX 4.1 without patch ESX410-201404402-SG
VMware ESX 4.0 without patch ESX400-201404402-SG

3. Problem Description

a. DDoS vulnerability in NTP third party libraries

The NTP daemon has a DDoS vulnerability in the handling of the "monlist" command. An attacker may send a forged request to a vulnerable NTP server resulting in an amplified response to the intended target of the DDoS attack.

Mitigation

Mitigation for this issue is documented in VMware Knowledge Base article 2070193. This article also documents when vSphere products are affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-5211 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

b. Update to ESXi glibc package

The ESXi glibc package is updated to version glibc-2.5-118.el5_10.2 to resolve a security issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-4332 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

c. vCenter and Update Manager, Oracle JRE 1.7 Update 45

Oracle JRE is updated to version JRE 1.7 Update 45, which addresses multiple security issues that existed in earlier releases of Oracle JRE.

Oracle has documented the CVE identifiers that are addressed in JRE 1.7.0 update 45 in the Oracle Java SE Critical Patch Update Advisory of October 2013. The References section provides a link to this advisory.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

* this product uses the Oracle JRE 1.5.0 family
** this product uses the Oracle JRE 1.6.0 family

4. Solution

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

vCenter Server 5.5
Download link:
https://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/5_5

Release Notes:
https://www.vmware.com/support/vsphere5/doc/vsphere-vcenter-server-55u1-release-notes.html

ESXi 5.5
File: update-from-esxi5.5-5.5_update01.zip
md5sum:5773844efc7d8e43135de46801d6ea25
sha1sum:6518355d260e81b562c66c5016781db9f077161f
http://kb.vmware.com/kb/2065826
update-from-esxi5.5-5.5_update01 contains ESXi550-201403101-SG

ESXi 5.1
File: ESXi510-201404001.zip
md5sum:9dc3c9538de4451244a2b62d247e52c4
sha1sum:6b1ea36a2711665a670afc9ae37cdd616bb6da66
http://kb.vmware.com/kb/2070666
ESXi510-201404001 contains ESXi510-201404101-SG

ESXi 5.0
File: ESXi500-201405001.zip
md5sum: 7cd1afc97f5f1e4b4132c90835f92e1d
sha1sum: 4bd77eeb5d7fc65bbb6f25762b0fa74fbb9679d5
http://kb.vmware.com/kb/2075521
ESXi500-201405001 contains ESXi500-201405101-SG

ESXi 4.1
File: ESXi410-201404001.zip
md5sum: bc4a5963fd9aace6b43e8c96f66a0536
sha1sum: f80a7a33f7d5e5cd22a7d2cbd65b0cc056cff745
http://kb.vmware.com/kb/2072477
ESXi410-201403001.zip contains ESXi410-201404401-SG

ESXi 4.0
File: ESXi400-201404001.zip
md5sum: c10a17635fa4a5ffa4971d0437494488
sha1sum: e2f5bc165aef118257d498ff1a9ecba74b2c648e
http://kb.vmware.com/kb/2068805
ESXi400-201404001.zip contains ESXi400-201404401-SG

ESX 4.1
File: ESX410-201404001.zip
md5sum: 320ce06e2ef68def3ba278b87c0f3104
sha1sum: 5db78957208902b922a29976296cc5d948dbc1d7
http://kb.vmware.com/kb/2072476
ESX410-201404001.zip contains ESX410-201404402-SG

ESX 4.0
File: ESX400-201404001.zip
md5sum: a1f984a3d224dc35bdb450530167476f
sha1sum: 14a1612d99998df3fa5ef88956ac730de7d594fe
http://kb.vmware.com/kb/2068798
ESX400-201404001.zip contains ESX400-201404402-SG

5. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332

JRE
Oracle Java SE Critical Patch Update Advisory of October 2013
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html

VMware Knowledge Base article 2070193
http://kb.vmware.com/kb/2070193

6. Change log

2014-03-11 VMSA-2014-0002
Initial security advisory in conjunction with the release of vSphere 5.5 Update 1 on 2014-03-11

2014-04-10 VMSA-2014-0002.1
Updated security advisory in conjunction with the release of ESXi/ESX 4.0 and 4.1 patches on 2014-04-10

2014-04-29 VMSA-2014-0002.2
Updated security advisory in conjunction with the release of ESXi 5.1 patches on 2014-04-29

2014-05-29 VMSA-2014-0002.3
Updated security advisory in conjunction with the release of ESXi 5.0 patches on 2014-05-29

2014-12-04 VMSA-2014-0002.4
Updated security advisory in conjunction with the release of VMware vCSA 5.1 Update 3 released on 2014-12-04.

7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* fulldisclosure at seclists.org

E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Advisories
http://www.vmware.com/security/advisories

VMware Security Response Policy
http://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html

Twitter
https://twitter.com/VMwareSRC

Copyright 2014 VMware Inc.  All rights reserved.