Support Content Notification - Support Portal

VMSA-2014-0010.13

VMware product updates address critical Bash security vulnerabilities

VMware Security Advisory

VMware Security Advisory Advisory ID:

VMSA-2014-0010.13

VMware Security Advisory Synopsis:

VMware product updates address critical Bash security vulnerabilities

VMware Security Advisory Issue date:

2014-09-30

VMware Security Advisory Updated on:

2014-10-17

VMware Security Advisory CVE numbers:

CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278

1. Summary

VMware product updates address Bash security vulnerabilities.

2. Relevant Releases (Affected products for which remediation is present)

ESX 4.1 without patch ESX410-201410401-SG
ESX 4.0 without patch ESX400-201410401-SG

vCenter Server Appliance prior to 5.5 U2a
vCenter Server Appliance prior to 5.1 U2b
vCenter Server Appliance prior to 5.0 U3b
Horizon DaaS Platform prior to 6.1.1
Horizon DaaS Platform prior to 6.0.2
Horizon DaaS Platform prior to 5.4.3
Horizon Workspace 1.x, 2.x without patch
IT Business Management Suite prior to 1.1.0
IT Business Management Suite prior to 1.0.1
NSX for Multi-Hypervisor 4.2.x prior to 4.2.1
NSX for Multi-Hypervisor 4.1.x prior to 4.1.4
NSX for Multi-Hypervisor 4.0.x prior to 4.0.5
NSX for vSphere 6.1.x prior to 6.1.1
NSX for vSphere 6.0.x prior to 6.0.7
NVP 3.x prior to 3.2.4
vCenter Application Discovery Manager without patch
vCenter Converter Standalone 5.5.x prior to 5.5.3
vCenter Converter Standalone 5.1.x prior to 5.1.2
vCenter Hyperic Server prior to 5.8.3
vCenter Hyperic Server 5.8.2 without SP3
vCenter Hyperic Server 5.8.1 without SP3
vCenter Hyperic Server 5.8.0 without SP2
vCenter Hyperic Server prior to 5.7.2
vCenter Hyperic Server 5.7.1 without SP1
vCenter Hyperic Server prior to 5.0.3
vCenter Hyperic Server 5.0.2 without SP1
vCenter Infrastructure Navigator prior to 5.8.3
vCenter Infrastructure Navigator prior to 5.7.1
vCenter Infrastructure Navigator prior to 2.0.1
vCenter Log Insight prior to 2.0.5
vCenter Log Insight prior to 2.0U1
vCenter Log Insight prior to 1.5.0U1
vCenter Operations Manager 5.x without patch
vCenter Orchestrator Appliance 5.5.x prior to 5.5.2.1
vCenter Orchestrator Appliance 5.1.x, 4.x without patch
vCenter Site Recovery Manager prior to 5.5.1.3
vCenter Site Recovery Manager prior to 5.1.2.2
vCenter Support Assistant without patch
vCloud Application Director 5.x, 6.x without patch
vCloud Automation Center 6.x without patch
vCloud Automation Center Application Services 6.x without patch
vCloud Director Appliance prior to 5.5.1.3
vCloud Connector prior to 2.6.1
vCloud Networking and Security prior to 5.5.3.1
vCloud Networking and Security prior to 5.1.4.3
vCloud Usage Meter prior to 3.3.2
vFabric Postgres prior to 9.3.5.1
vFabric Postgres prior to 9.2.9.1
vFabric Postgres prior to 9.1.14.1
VMware Application Dependency Planner prior to 2.0.0.1
View Planner prior to 3.0.1.1
VMware Data Recovery prior to 2.0.4
VMware HealthAnalyzer prior to 5.0.3.1
VMware Socialcast On Premise prior to 2-116-1
VMware Socialcast On Premise prior to 2-112-1
VMware Studio 2.x without patch
VMware Workbench prior to 3.0.2
vSphere App HA prior to 1.1.1
vSphere App HA 1.1.0 without patch
vSphere Big Data Extensions 2.x without patch
vSphere Data Protection 5.x without patch
vSphere Management Assistant 5.5.x without 5.5 EP1
vSphere Management Assistant 5.1.x without 5.1.0.2
vSphere Management Assistant 5.0.x without 5.0 EP1
vSphere Replication prior to 5.8.0.1
vSphere Replication prior to 5.6.0.2
vSphere Replication prior to 5.5.1.3
vSphere Replication prior to 5.1.2.2
vSphere Storage Appliance prior to 5.5.2
vSphere Storage Appliance 5.1.x without patch

3. Problem Description

a. Bash update for multiple products.

Bash libraries have been updated in multiple products to resolve multiple critical security issues, also referred to as Shellshock.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 to these issues.

VMware products have been grouped into the following four product categories:

I) ESXi and ESX Hypervisor
ESXi is not affected because ESXi uses the Ash shell (through busybox), which is not affected by the vulnerability reported for the Bash shell. ESX has an affected version of the Bash shell.
See table 1 for remediation for ESX.

II) Windows-based products
Windows-based products, including all versions of vCenter Server running on Windows, are not affected.

III) VMware (virtual) appliances
VMware (virtual) appliances ship with an affected version of Bash.
See table 2 for remediation for appliances.

IV) Products that run on Linux, Android, OSX or iOS (excluding virtual appliances)
Products that run on Linux, Android, OSX or iOS (excluding virtual appliances) might use the Bash shell that is part of the operating system. If the operating system has a vulnerable version of Bash, the Bash security vulnerability might be exploited through the product. VMware recommends that customers contact their operating system vendor for a patch.

MITIGATIONS

VMware encourages restricting access to appliances through firewall rules and other network layer controls to only trusted IP addresses. This measure will greatly reduce any risk to these appliances.

RECOMMENDATIONS

VMware recommends customers evaluate and deploy patches for affected products in Table 1 and 2 below as these patches become available.

For several products, both a patch and a product update are available. In general, if a patch is made available, the patch must be applied to the latest version of the appliance.

Customers should refer to the specific product Knowledge Base articles listed in Section 4 to understand the type of remediation available and applicable appliance version numbers.

Column 4 of the following tables lists the action required to remediate the vulnerability in each release, if a solution is available.

Table 1 - ESXi and ESX Hypervisor

VMware Product

Product Version

Running on

Replace with/ Apply Patch

VMware Product ESXi

Product Version any

Running on ESXi

Replace with/ Apply Patch Not Affected

VMware Product ESX

Product Version 4.1

Running on ESX

Replace with/ Apply Patch ESX410-201410401-SG*

VMware Product ESX

Product Version 4.0

Running on ESX

Replace with/ Apply Patch ESX400-201410401-SG*

* VMware has made VMware ESX 4.0 and 4.1 security patches available for the Bash shell vulnerability. This security patch release is an exception to the existing VMware lifecycle Policy.

Table 2 - Products that are shipped as a (virtual) appliance.

VMware Product

Product Version

Running on

Replace with / Apply Patch

VMware Product vCenter Server Appliance

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.5 U2a, 5.1 U2b, 5.0 U3b

VMware Product Horizon DaaS Platform

Product Version 6.x

Running on Linux

Replace with / Apply Patch 6.1.1, 6.0.2, 5.4.3

VMware Product Horizon Workspace

Product Version 1.x, 2.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product IT Business Management Suite

Product Version 1.x

Running on Linux

Replace with / Apply Patch 1.1.0, 1.0.1

VMware Product NSX for Multi-Hypervisor

Product Version 4.x

Running on Linux

Replace with / Apply Patch 4.2.1, 4.1.4, 4.0.5

VMware Product NSX for vSphere

Product Version 6.x

Running on Linux

Replace with / Apply Patch 6.1.1, 6.0.7

VMware Product NVP

Product Version 3.x

Running on Linux

Replace with / Apply Patch 3.2.4

VMware Product vCenter Converter Standalone

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.5.3, 5.1.2**

VMware Product vCenter Application Discovery Manager

Product Version 7.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vCenter Hyperic Server*

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.8.3, 5.8.2-SP3, 5.8.1-SP3, 5.8.0-SP2, 5.7.2, 5.7.1-SP1, 5.0.3, 5.0.2-SP1

VMware Product vCenter Infrastructure Navigator

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.8.3, 5.7.1, 2.0.1

VMware Product vCenter Log Insight

Product Version 1.x, 2.x

Running on Linux

Replace with / Apply Patch 2.0.5, 2.0U1, 1.5.0U1

VMware Product vCenter Operations Manager

Product Version 5.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vCenter Orchestrator Appliance*

Product Version 4.x, 5.x

Running on Linux

Replace with / Apply Patch

5.5.2.1
5.1.2 and 4.2.3 - See Section 4

VMware Product vCenter Site Recovery Manager

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.5.1.3, 5.1.2.2, 5.0.x**

VMware Product vCenter Support Assistant

Product Version 5.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vCloud Application Director

Product Version 5.x, 6.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vCloud Automation Center

Product Version 6.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vCloud Automation Center Application Services

Product Version 6.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vCloud Director Appliance

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.5.1.3

VMware Product vCloud Connector

Product Version 2.x

Running on Linux

Replace with / Apply Patch 2.6.1

VMware Product vCloud Networking and Security

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.5.3.1, 5.1.4.3

VMware Product vCloud Usage Meter

Product Version 3.x

Running on Linux

Replace with / Apply Patch 3.3.2

VMware Product vFabric Postgres

Product Version 9.x

Running on Linux

Replace with / Apply Patch 9.3.5.1, 9.2.9.1, 9.1.14.1

VMware Product View Planner

Product Version 3.x

Running on Linux

Replace with / Apply Patch 3.0.1.1

VMware Product VMware Application Dependency Planner

Product Version x.x

Running on Linux

Replace with / Apply Patch 2.0.0.1

VMware Product VMware Data Recovery

Product Version 2.x

Running on Linux

Replace with / Apply Patch 2.0.4

VMware Product VMware HealthAnalyzer

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.0.3.1

VMware Product VMware Socialcast On Premise

Product Version 2.x

Running on Linux

Replace with / Apply Patch 2-112-1, 2-116-1

VMware Product VMware Studio

Product Version 2.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product VMware Workbench

Product Version 3.0.x

Running on Linux

Replace with / Apply Patch 3.0.2

VMware Product vSphere App HA*

Product Version 1.x

Running on Linux

Replace with / Apply Patch 1.1.1

VMware Product vSphere Big Data Extensions

Product Version 1.x, 2.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vSphere Data Protection

Product Version 5.x

Running on Linux

Replace with / Apply Patch See Section 4

VMware Product vSphere Management Assistant

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.5 EP1, 5.1.0.2, 5.0 EP1

VMware Product vSphere Replication

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.8.0.1, 5.6.0.2, 5.5.1.3, 5.1.2.2

VMware Product vSphere Storage Appliance*

Product Version 5.x

Running on Linux

Replace with / Apply Patch 5.5.2, 5.1.3 - See Section 4

* This product has patches available to update bash manually as well as a full installation that includes the bash fix for some versions. Either installing the patch or upgrading the appliance will remediate the "shellshock" vulnerability. See documentation in Section 4 for details.

** This product includes Virtual Appliances that will be updated, the product itself is not a Virtual Appliance.

4. Solution

ESX
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2090859
http://kb.vmware.com/kb/2090853

vCenter Server Appliance
Downloads:
https://my.vmware.com/web/vmware/details?productId=353&downloadGroup=VC55U2
(scroll down to 5.5 Update 2a Appliance)
https://my.vmware.com/web/vmware/details?productId=285&downloadGroup=VCL-VSP510-VC-51U2A
(scroll down to 5.1 Update 2b Appliance)
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VC50U3A
(scroll down to 5.0 Update 3b Appliance)
Documentation:
http://kb.vmware.com/kb/2091085
http://kb.vmware.com/kb/2091018
http://kb.vmware.com/kb/2091017

Horizon DaaS Platform
Downloads:
https://my.vmware.com/web/vmware/details?productId=405&rPId=6527&downloadGroup=HORIZON-DAAS-610-BIN
https://my.vmware.com/web/vmware/details?productId=405&downloadGroup=HORIZON-DAAS-602
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-ONPREM-540&productId=398
Documentation:
http://kb.vmware.com/kb/2091183

IT Business Management Suite
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-110&productId=384&rPId=6384
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-101&productId=385&rPId=6333
Documentation:
http://kb.vmware.com/kb/2091014
http://kb.vmware.com/kb/2091013

NSX for Multi-Hypervisor
Downloads:
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-MH-421
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-MH-414
Note: For 4.0.5 refer to http://www.vmware.com/products/nsx
Documentation:
http://kb.vmware.com/kb/2091179
http://kb.vmware.com/kb/2091205

NSX for vSphere
Downloads:
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-V-611
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-V-607
Documentation:
http://kb.vmware.com/kb/2091213
http://kb.vmware.com/kb/2091216

vCenter Converter Standalone
Downloads:
https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_management/vmware_vcenter_converter_standalone/5_5
https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_management/vmware_vcenter_converter_standalone/5_1
Documentation:
http://kb.vmware.com/kb/2091104
http://kb.vmware.com/kb/2091102

NVP
Downloads and Documentation:
http://www.vmware.com/products/nsx

Application Discovery Manager
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VADM-700-VA&productId=300&rPId=3036

Documentation:
http://kb.vmware.com/kb/2092300

vCenter Support Assistant
Downloads and Documentation:
http://kb.vmware.com/kb/2091112

vCloud Application Director
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPDIR_601_GA&productId=383&rPId=6216
https://my.vmware.com/web/vmware/details?downloadGroup=VFAPPDIR_520_GA&productId=345&rPId=3789
Documentation:
http://kb.vmware.com/kb/2091129

vCloud Automation Center
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-610&productId=447&rPId=6501
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-6012&productId=383&rPId=6216
Documentation:
http://kb.vmware.com/kb/2091012

vCloud Automation Center Application Services
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPSER_610&productId=447&rPId=6501
Documentation:
http://kb.vmware.com/kb/2091129

vCloud Director Appliance
Downloads:
www.vmware.com/go/try-vcloud-director
Documentation:
http://kb.vmware.com/kb/2091071

vCloud Connector
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCC261-GA
Documentation:
http://kb.vmware.com/kb/2091045

vCloud Networking and Security
Downloads:
https://my.vmware.com/group/vmware/get-download?downloadGroup=VCNS5531
https://my.vmware.com/group/vmware/get-download?downloadGroup=VCNS5143
Documentation:
http://kb.vmware.com/kb/2091218
http://kb.vmware.com/kb/2091217

vCloud Usage Meter
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=UMSV332
Documentation:
http://kb.vmware.com/kb/2091184

vFabric Postgres
Downloads:
https://my.vmware.com/web/vmware/info/slug/application_platform/vmware_vfabric_postgres/9_3
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfabric_postgres/9_2
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfabric_postgres/9_1
Documentation:
http://kb.vmware.com/kb/2091055

View Planner
View Planner Benchmark Mode

Downloads:
https://my.vmware.com/web/vmware/details?productId=320&downloadGroup=VIEW-PLAN-300
Documentation:
http://kb.vmware.com/kb/2091281

View Planner Flexible Mode

Downloads and Documentation:
https://vmware.my.salesforce.com/06980000001EUza

VMware Application Dependency Planner
Downloads and Documentation:
https://vmware.my.salesforce.com/06980000001EUzQ

VMware Data Recovery
Downloads:
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VDR204
Documentation:
http://kb.vmware.com/kb/2091015

VMware HealthAnalyzer
Downloads and Documentation:
https://vmware.my.salesforce.com/06980000001EUzV

VMware Studio
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=STUDIO2600GA&productId=230
Documentation:
http://kb.vmware.com/kb/2091990

VMware Workbench
Downloads and Documentation:
https://developercenter.vmware.com/group/workbench/vm/3.0

vSphere Storage Appliance
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP55-VSA-552&productId=354&rPId=6585
https://my.vmware.com/web/vmware/details?downloadGroup=VSP51-VSA-513&productId=297&rPId=3752
Documentation:
http://kb.vmware.com/kb/2091000
http://kb.vmware.com/kb/2091086

5. References

VMware Knowledge Base Article 2090740
http://kb.vmware.com/kb/2090740

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278

6. Change Log

2014-09-30 VMSA-2014-0010
Initial security advisory in conjunction with the release of vCenter Log Insight 2.0 U1 on 2014-09-30.

2014-10-01 VMSA-2014-0010.1
Updated advisory in conjunction with the release of ESX 4.x patches, vCenter Server Appliance 5.5 U2a, 5.1 U2b, and 5.0 U3b, vCloud Director Appliance 5.5.1.3, VMware Data Recovery 2.0.4, vSphere Storage Appliance 5.5.2 on 2014-10-01. Added CVE-2014-6277 and CVE-2014-6278 as they have been confirmed to be mitigated.

2014-10-01 VMSA-2014-0010.2
Updated advisory in conjunction with the release of Horizon Workspace patches, IT Business Management Suite 1.1.0 and 1.0.1, vCenter Operations Manager patches, vCenter Site Recovery Manager 5.5.1.3 and 5.1.2.2, vCloud Application Director patches, vCloud Automation Center patches, vCloud Automation Center Application Services patches, vCloud Director Appliance 5.5.1.3, vFabric Postgres 9.3.5.1, 9.2.9.1, and 9.1.14.1, vSphere Replication 5.8.0.1, 5.5.1.3, and 5.1.2.2 on 2014-10-01.

2014-10-02 VMSA-2014-0010.3
Updated advisory in conjunction with the release of vCenter Hyperic Server 5.8.3, 5.7.2, and 5.0.3, vCenter Infrastructure Navigator 5.8.3, 5.7.1, and 2.0.1, vCenter Orchestrator Appliance patches, vCenter Support Assistant patches, vSphere App HA 1.1.1, vSphere Management Assistant 5.5 EP1 and 5.0 EP1, and vSphere Storage Appliance patches on 2014-10-02.

2014-10-02 VMSA-2014-0010.4
Updated advisory in conjunction with the release of Horizon DaaS Platform 6.1.1, 6.0.2, and 5.4.3, vCenter Orchestrator Appliance 5.5.2.1, vCloud Connector 2.6.1, vCloud Usage Meter 3.3.2, and vSphere Replication 5.6.0.2 on 2014-10-02.

2014-10-03 VMSA-2014-0010.5
Updated advisory in conjunction with the release of vCloud Networking and Security 5.5.3.1 and 5.1.4.3 on 2014-10-03.

2014-10-04 VMSA-2014-0010.6
Updated advisory in conjunction with the release of NSX for Multi-Hypervisor 4.2.1, 4.1.4, and 4.0.5, NSX for vSphere 6.1.1 and 6.0.7, NVP 3.2.4, and vSphere Big Data Extensions 2.x patch on 2014-10-04.

2014-10-05 VMSA-2014-0010.7
Updated advisory in conjunction with the release of View Planner Benchmark 3.0.1.1, and vSphere Data Protection 5.x patch on 2014-10-05.

2014-10-06 VMSA-2014-0010.8
Updated advisory in conjunction with the release of vCenter Hyperic Server 5.8.2 SP3, 5.8.1 SP3, 5.8.0 SP2, 5.7.1 SP1, and 5.0.2 SP1, vCenter Log Insight 1.5.0U1, View Planner Flexible 3.0.1.1, VMware Application Dependency Planner 2.0.0.1, VMware HealthAnalyzer 5.0.3.1, and vSphere App HA 1.1.0 patch on 2014-10-06.

2014-10-07 VMSA-2014-0010.9
Updated advisory in conjunction with the release of vCenter Operations Manager patches, VMware Socialcast On Premise 2-116-1 and 2-112-1, and vSphere Data Protection patches on 2014-10-07.

2014-10-08 VMSA-2014-0010.10
Updated advisory in conjunction with the release of vCenter Operations Manager patches on 2014-10-08.

2014-10-09 VMSA-2014-0010.11
Updated advisory in conjunction with the release of vCenter Converter Standalone 5.5.3 and 5.1.2, and vCenter Log Insight 2.0.5 on 2014-10-09.

2014-10-13 VMSA-2014-0010.12
Updated advisory in conjunction with the release of VMware Studio 2.x patch on 2014-10-13.

2014-10-17 VMSA-2014-0010.13
Updated advisory in conjunction with the release of vCenter Application Discovery Manager 7.0 patch, vSphere Management Assistant 5.1.0.2, and VMware Workbench 3.0.2 on 2014-10-17.

7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

security-announce at lists.vmware.com
bugtraq at securityfocus.com
fulldisclosure at seclists.org

E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Advisories
http://www.vmware.com/security/advisories

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Policy
https://www.vmware.com/support/policies/lifecycle.html

Twitter
https://twitter.com/VMwareSRC