-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2011-0008 Synopsis: VMware vCenter Server and vSphere Client security vulnerabilities Issue date: 2011-05-05 Updated on: 2011-05-05 (initial release of advisory) CVE numbers: CVE-2011-0426 CVE-2011-1788 CVE-2011-1789 - ------------------------------------------------------------------------ 1. Summary VMware vCenter Server directory traversal and information disclosure vulnerabilities. vSphere Client Installer is delivered through an unsigned package. 2. Relevant releases vCenter Server 4.1 GA vCenter Server 4.0 Update 2 and earlier VirtualCenter 2.5 Update 6 and earlier ESXi 4.1 GA ESXi 4.0 without patch ESXi400-201103402-SG ESX 4.1 GA ESX 4.0 without patch ESX400-201103401-SG 3. Problem Description a. vCenter Server Directory Traversal vulnerability A directory traversal vulnerability allows an attacker to remotely retrieve files from vCenter Server without authentication. In order to exploit this vulnerability, the attacker will need to have access to the network on which the vCenter Server host resides. In case vCenter Server is installed on Windows 2008 or Windows 2008 R2, the security vulnerability is not present. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2011-0426 to this issue. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= vCenter 4.1 Windows Update 1 * vCenter 4.0 Windows Update 3 * VirtualCenter 2.5 Windows Update 6a hosted ** any any not affected ESXi any ESXi not affected ESX any ESX not affected * vCenter 4.1 and vCenter 4.0 installed on Windows 2008 or Windows 2008 R2 is not affected ** hosted products are VMware Workstation, Player, ACE, Fusion. b. vCenter Server SOAP ID disclosure The SOAP session ID can be retrieved by any user that is logged in to vCenter Server. This might allow a local unprivileged user on vCenter Server to elevate his or her privileges. VMware would like to thank Claudio Criscione for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2011-1788 to this issue. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= vCenter 4.1 Windows Update 1 vCenter 4.0 Windows Update 3 VirtualCenter 2.5 Windows not affected hosted * any any not affected ESXi any ESXi not affected ESX any ESX not affected * hosted products are VMware Workstation, Player, ACE, Fusion. c. vSphere Client Installer package not digitally signed The digitally signed vSphere Client installer is packaged in a self-extracting installer package which is not digitally signed. As a result, when you run the install package file to extract and start installing, the vSphere Client installer may display a Windows warning message stating that the publisher of the install package cannot be verified. The vSphere Client Installer package of the following product versions is now digitally signed: vCenter Server 4.1 Update 1 vCenter Server 4.0 Update 3 ESXi 4.1 Update 1 ESXi 4.0 with patch ESXi400-201103402-SG ESX 4.1 Update 1 ESX 4.0 with patch ESX400-201103401-SG An install or update of the vSphere Client from these releases will not present a security warning from Windows. Note: typically the vSphere Client will request an update if the existing client is pointed at a newer version of vCenter or ESX. VMware Knowledge Base article 1021404 explains how the unsigned install package can be obtained in an alternative, secure way for an environment with VirtualCenter 2.5, ESXi/ESX 3.5 or ESX 3.0.3. VMware would like to thank Claudio Criscione for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2011-1789 to this issue. 4. Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. vCenter Server 4.1 Update 1 --------------------------- See VMSA-2011-0003 for details. vCenter Server 4.0 Update 3 --------------------------- http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vsphere_4/4_ 0 Release Notes: http://www.vmware.com/support/vsphere4/doc/vsp_vc40_u3_rel_notes.html File type: .iso md5sum: b04780df75f70621d0c8794e8773a983 sha1sum: a9f1398306158572ea1c3d202ed8c6ad922e0764 File type: .zip md5sum: bc8179a639dcc6563d7dbf968095edc7 sha1sum: 61b6dbb1bcf3aa74503e183317a00733b0253faa VMware vSphere Client File type: .exe md5sum: 1b90081e422358c407ad9696c70c70f7 sha1sum: 7ba9043421f8b529b0da08fa83458069ccac0fe9 VirtualCenter Server 2.5 Update 6a ---------------------------------- http://downloads.vmware.com/d/info/datacenter_downloads/vmware_infrastructu re_3/3_5 Release Notes: http://downloads.vmware.com/support/vi3/doc/vi3_vc25u6_rel_notes.html File type: .iso md5sum: de8c246cf136b382b13be1993ca6ca3f sha1sum: e32ec136425b3fb77afa03d8e6666a6b096debbc File type: .zip md5sum: 41bdc78ba9b06a1691635f1a79062f97 sha1sum: 3db04c0da053c05fab15900e127a7b20c80ee8a5 ESXi 4.0 -------- ESXi400-201103001 https://hostupdate.vmware.com/software/VUM/OFFLINE/release-274-20110303-677 367/ESXi400-201103001.zip md5sum: a68ef31414573460cdadef4d81fb95d0 sha1sum: 7155e60962b21b5c295a2e9412ac4a445382db31 http://kb.vmware.com/kb/1032823 ESXi400-201103001 contains ESXi400-201103402-SG ESX 4.0 ------- ESX400-201103001 Download link: https://hostupdate.vmware.com/software/VUM/OFFLINE/release-273-20110303-574 144/ESX400-201103001.zip md5sum: 5b9a0cfe6c0ff1467c09c8d115910ff8 sha1sum: 8bfb5df8066a01704eaa24e4d8a34f371816904b http://kb.vmware.com/kb/1032822 ESX400-201103001 contains ESX400-201103401-SG 5. References CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0426 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1788 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1789 VMware KB 1021404 http://kb.vmware.com/kb/1021404 VMSA-2011-0003 http://www.vmware.com/security/advisories/VMSA-2011-0003.html - ------------------------------------------------------------------------ 6. Change log 2011-05-05 VMSA-2011-0008 Initial security advisory in conjunction with the release of vCenter Server 4.0 Update 3 and VirtualCenter 2.5 Update 6a on 2011-05-05. - ------------------------------------------------------------------------ 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware security response policy http://www.vmware.com/support/policies/security_response.html General support life cycle policy http://www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html Copyright 2011 VMware Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.8.3 (Build 4028) Charset: utf-8 wj8DBQFNw4h7DEcm8Vbi9kMRAvcJAKDDgU8WJ6Psfk/un1C89HEK1FFO8QCeMosW trHGAda4O8F290WlmFH8idI= =kiJZ -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/