VMSA-2016-0013:VMware Identity Manager and vRealize Automation updates address multiple security issues

VMware Tanzu Application Service

0 more products

23487

21 August 2016

21 August 2016

CLOSED

HIGH

CVE-2016-5335,CVE-2016-5336

VMSA-2016-0013

VMware Identity Manager and vRealize Automation updates address multiple security issues

VMware Security Advisory
 
VMware Security Advisory Advisory ID:
 VMSA-2016-0013
VMware Security Advisory Severity:
 Important
VMware Security Advisory Synopsis:
 VMware Identity Manager and vRealize Automation updates address multiple security issues
VMware Security Advisory Issue date:
 2016-08-23
VMware Security Advisory Updated on:
 2016-08-23 (Initial Advisory)
VMware Security Advisory CVE numbers:
 CVE-2016-5335, CVE-2016-5336
 
1. Summary

VMware Identity Manager and vRealize Automation updates address multiple security issues

 
2. Relevant Products
  • VMware Identity Manager
  • vRealize Automation
  •  
3. Problem Description

a. VMware Identity Manager local privilege escalation vulnerability  

 

VMware Identity Manager and vRealize Automation both contain a vulnerability that may allow for a local privilege escalation. Exploitation of this issue may lead to an attacker with access to a low-privileged account to escalate their privileges to that of root.  

 

The Common Vulnerabilities and Exposures project (cve.mitre.org) has reserved the identifier CVE-2016-5335 for this issue.  

 

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

 

VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch*
Workaround
VMware ProductVMware Identity Manager
Product Version2.x
Running on VA
SeverityImportant
Replace with/ Apply Patch*2.7
WorkaroundNone
VMware ProductvRealize Automation
Product Version7.0.x
Running on VA
SeverityImportant
Replace with/ Apply Patch*7.1
WorkaroundNone
VMware ProductvRealize Automation
Product Version6.x
Running on 6.x
SeverityN/A
Replace with/ Apply Patch*not affected
WorkaroundN/A

 

b. vRealize Automation remote code execution vulnerability      

 

vRealize Automation contains a vulnerability that may allow for remote code execution. Exploitation of this issue may lead to an attacker gaining access to a low-privileged account on the appliance.     

 

The Common Vulnerabilities and Exposures project (cve.mitre.org) has reserved the identifier CVE-2016-5336 for this issue. 

 

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch*
Workaround
VMware ProductvRealize Automation
Product Version7.0.x
Running on VA
SeverityImportant
Replace with/ Apply Patch*7.1
WorkaroundKB2146585
VMware ProductvRealize Automation
Product Version6.x
Running on VA
SeverityN/A
Replace with/ Apply Patch*not affected
WorkaroundN/A

 

 

4. Solution

 

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

VMware Identity Manager 2.7

-------------------------------------------

Downloads and Documentation     

 

vRealize Automation 7.1  

----------------------------------

Downloads and Documentation

 

5. References

 

          http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5335 

          http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5336

          https://kb.vmware.com/kb/2146585

 

6. Change log

 

2016-08-23 VMSA-2016-0013 Initial security advisory in conjunction with the release of vRealize Automation 7.1 on 2016-08-23.

 

7. Contact

 

E-mail list for product security notifications and announcements:

http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

 

This Security Advisory is posted to the following lists:

[email protected]

[email protected]

[email protected]

 

E-mail: [email protected]

PGP key at: https://kb.vmware.com/kb/1055

 

VMware Security Advisories

http://www.vmware.com/security/advisories

 

 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html

 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html

 

Twitter

https://twitter.com/VMwareSRC

 

Copyright 2016 VMware Inc. All rights reserved.