VMSA-2016-0012:VMware Photon OS OVA default public ssh key

Product/Component

Notification Id

23486

Last Updated

13 August 2016

Initial Publication Date

13 August 2016

CLOSED

HIGH

CVE-2016-5333

VMSA-2016-0012

VMware Photon OS OVA default public ssh key

VMware Security Advisory
 
VMware Security Advisory Advisory ID:
 VMSA-2016-0012
VMware Security Advisory Severity:
 Important
VMware Security Advisory Synopsis:
VMware Photon OS OVA default public ssh key
VMware Security Advisory Issue date:
 2016-08-15
VMware Security Advisory Updated on:
 2016-08-15 (Initial Advisory)
VMware Security Advisory CVE numbers:
CVE-2016-5333
 
1. Summary

VMware Photon OS OVA contains a default public ssh key.

 
2. Relevant Products
  • VMware Photon OS OVA 1.0
  •  
3. Problem Description

a. VMware Photon OS OVA default public ssh key  

 

A public ssh key used in the Photon OS build environment was inadvertently left in the original Photon OS 1.0 OVAs. This issue would have allowed anyone with the corresponding private key to access any Photon OS system built from the original 1.0 OVAs.

 

The issue was discovered internally and the original OVAs have been replaced by updated OVAs. All instances of the corresponding private key have been deleted within VMware.    

 

Customers that have downloaded a Photon OS 1.0 OVA before August 14, 2016 should review the Photon OS OVAs release notes for the workaround or should download a new OVA and replace all existing instances with new instances built from the updated Photon OS 1.0 OVAs. These release notes also document a test for when an OVA is affected.

 

This issue is only present in the original Photon OS 1.0 OVAs and is not present in other Photon OS deliverables.

 

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2016-5333 to this issue.

 

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is   available.

VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch*
Workaround
VMware ProductPhoton OS OVA
Product Version1.0
Running on Linux
SeverityImportant
Replace with/ Apply Patch*Updated Photon OS OVAs 1.0
WorkaroundSee Photon OS Release Notes

 

 

4. Solution

 

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
 

VMware Photon OS 1.0 OVA  

OVA Download  

https://github.com/vmware/photon/wiki/Downloading-Photon-OS

Release Notes

https://github.com/vmware/photon/blob/master/CHANGELOG.md

 

5. References

 

          CVE-2016-5332

 

          Photon OS OVA Release Notes  

6. Change log

 

  2016-08-15 VMSA-2016-0012

  Initial security advisory in conjunction with the release of updated Photon OS 1.0 OVAs

  on 2016-08-15.

 

7. Contact

 

E-mail list for product security notifications and announcements:

http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

 

This Security Advisory is posted to the following lists:

[email protected]

[email protected]

[email protected]

 

E-mail: [email protected]

PGP key at: https://kb.vmware.com/kb/1055

 

VMware Security Advisories

http://www.vmware.com/security/advisories

 

 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html

 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html

 

Twitter

https://twitter.com/VMwareSRC

 

Copyright 2016 VMware Inc. All rights reserved.