Ispravljen je sigurnosni nedostatak programskih paketa VMware vCenter Orchestrator i Alive Enterprise koji su napadači mogli iskoristiti za izvršavanje zlonamjernog programskog koda.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2011-0005.3
Synopsis: VMware vCenter Orchestrator and Alive Enterprise
remote code execution vulnerability
Issue date: 2011-03-14
Updated on: 2011-10-27
CVE numbers: CVE-2010-1870
- ------------------------------------------------------------------------
1. Summary
A vulnerability in VMware vCenter Orchestrator (vCO) and Alive
Enterprise could allow remote execution.
2. Relevant releases
VMware vCenter Orchestrator 4.1 Update 1 and earlier
VMware vCenter Orchestrator 4.0 Update 2 and earlier
Alive Enterprise 7.2
3. Problem Description
a. Vulnerability in third party Apache Struts component
VMware vCenter Orchestrator is an application to automate
management tasks. Alive Enterprise is an application to monitor
processes. Both products embed Apache Struts which is a third
party component.
The following vulnerability has been reported in Apache Struts
2.0.11 or earlier. A remote execution of code vulnerability could
allow malicious users to bypass the '#'-usage protection built into
the ParametersInterceptor, which could allow server side context
objects to be manipulated.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1870 to this vulnerability.
VMware would like to thank the Vulnerability Research Team of
Digital Defense, Inc. for reporting this issue to us.
Apache Struts version 2.0.11 and earlier also contain
vulnerabilities which have not been assigned CVE names. This
advisory also addresses these vulnerabilities described at the
following URLs:
* http://struts.apache.org/2.2.1/docs/s2-002.html
* http://struts.apache.org/2.2.1/docs/s2-003.html
* http://struts.apache.org/2.2.1/docs/s2-004.html
Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
vCO 4.1 Windows Update 2 *
vCO 4.0 Windows Update 3 *
Alive 7.2 any affected, upgrade to vCenter
Enterprise Operations Enterprise 1.0 **
vCenter any any not affected
Operations
Standard
* With vCO 4.1 Update 2 and vCO 4.0 Update 3 the workaround in
VMware Knowledge Base article 1034175 is no longer necessary.
vCO is part of vCenter Server.
** Alive Enterprise has been renamed to vCenter Operations
Enterprise.
4. Solution
VMware vCenter Server 4.0
---------------------------
VMware vCenter Server 4.0 Update 3
The download for vCenter Server includes VMware vCenter Orchestrator.
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vsphere_4/4_0
Release Notes:
http://www.vmware.com/support/vsphere4/doc/vsp_vc40_u3_rel_notes.html
File type: .iso
md5sum: b04780df75f70621d0c8794e8773a983
sha1sum: a9f1398306158572ea1c3d202ed8c6ad922e0764
File type: .zip
md5sum: bc8179a639dcc6563d7dbf968095edc7
sha1sum: 61b6dbb1bcf3aa74503e183317a00733b0253faa
VMware vSphere Client
File type: .exe
md5sum: 1b90081e422358c407ad9696c70c70f7
sha1sum: 7ba9043421f8b529b0da08fa83458069ccac0fe9
VMware vCenter Server 4.1
---------------------------
VMware vCenter Server 4.1 Update 2
The download for vCenter Server includes VMware vCenter Orchestrator.
Download link:
http://downloads.vmware.com/d/info/datacenter_cloud_infrastructure/vmware_vsphere/4_1
Release Notes:
https://www.vmware.com/support/orchestrator/doc/vco_412_release_notes.html
File: VMware-VIMSetup-all-4.1.0-493063.iso
md5sum: d132326846a85bfc9ebbc53defeee6e1
sha1sum: 192c3e5d2a10bbe53c025cc7eedb3133a23e0541
File: VMware-VIMSetup-all-4.1.0-493063.zip
md5sum: 7fd7b09e501bd8fde52649b395491222
sha1sum: 46dd00e7c594ac672a5d7c3c27d15be2f5a5f1f1
File: VMware-viclient-all-4.1.0-491557.exe
md5sum: dafd31619ae66da65115ac3900697e3a
sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef
VMware vCenter Orchestrator
---------------------------
vCenter Orchestrator workaround for Apache Struts
http://kb.vmware.com/kb/1034175
VMware vCenter Operations Enterprise 1.0
---------------------------------
Download link
https://www.vmware.com/downloads/download.do?downloadGroup=VCOPS-ENT-10
Release notes
http://www.vmware.com/support/vcops/doc/vcops-enterprise10-release-notes.html
VMware vCenter Operations Enterprise 1.0 Windows Installer (x64 bit)
md5sum:a8c164c11217f05bcddd1cb87bc1d6a0
sha1sum:f4298268c75b3cc67a042401e2a2bae8c4ba7ac8
VMware vCenter Operations Enterprise 1.0 Linux Installer (x64 bit)
md5sum:b82b120fa03532efb844655668383280
sha1sum:663a2fc2039a6029a97fb02995088984c0cde430
5. References
CVE numbers
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1870
- ------------------------------------------------------------------------
6. Change log
2011-03-14 VMSA-2011-0005
Initial security advisory in conjunction with the release of an
Apache Struts workaround for VMware vCenter Orchestrator on
2011-03-14.
2011-04-12 VMSA-2011-0005.1
Update of security advisory after the release of vCenter Operations
Enterprise 1.0 on 2011-04-12.
2011-05-05 VMSA-2011-0005.2
Update of security advisory after the release of VMware vCenter
Orchestrator 4.0 Update 3 on 2011-05-05.
2011-10-27 VMSA-2011-0005.3
Update of security advisory after the release of VMware vCenter
Orchestrator 4.1 Update 2 on 2011-10-27.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2011 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk6qQQgACgkQDEcm8Vbi9kM+egCfWuosfRa5x/R+Coxs2L1ageri
BHkAn0+8l+8CkAJf8P6orF057yEp3k2F
=7JQ2
-----END PGP SIGNATURE-----
_______________________________________________
Security-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
http://lists.vmware.com/mailman/listinfo/security-announce
Posljednje sigurnosne preporuke