Sign up for Security
Advisories

Enter your email address:


VMSA-2014-0010.13

VMware product updates address critical Bash security vulnerabilities

VMware Security Advisory
Advisory ID: VMSA-2014-0010.13
Synopsis: VMware product updates address critical Bash security vulnerabilities
Issue date: 2014-09-30
Updated on: 2014-10-17
CVE numbers: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278
1. Summary
VMware product updates address Bash security vulnerabilities.
2. Relevant Releases (Affected products for which remediation is present)

ESX 4.1 without patch ESX410-201410401-SG
ESX 4.0 without patch ESX400-201410401-SG

vCenter Server Appliance prior to 5.5 U2a
vCenter Server Appliance prior to 5.1 U2b
vCenter Server Appliance prior to 5.0 U3b
Horizon DaaS Platform prior to 6.1.1
Horizon DaaS Platform prior to 6.0.2
Horizon DaaS Platform prior to 5.4.3
Horizon Workspace 1.x, 2.x without patch
IT Business Management Suite prior to 1.1.0
IT Business Management Suite prior to 1.0.1
NSX for Multi-Hypervisor 4.2.x prior to 4.2.1
NSX for Multi-Hypervisor 4.1.x prior to 4.1.4
NSX for Multi-Hypervisor 4.0.x prior to 4.0.5
NSX for vSphere 6.1.x prior to 6.1.1
NSX for vSphere 6.0.x prior to 6.0.7
NVP 3.x prior to 3.2.4
vCenter Application Discovery Manager without patch
vCenter Converter Standalone 5.5.x prior to 5.5.3
vCenter Converter Standalone 5.1.x prior to 5.1.2
vCenter Hyperic Server prior to 5.8.3
vCenter Hyperic Server 5.8.2 without SP3
vCenter Hyperic Server 5.8.1 without SP3
vCenter Hyperic Server 5.8.0 without SP2
vCenter Hyperic Server prior to 5.7.2
vCenter Hyperic Server 5.7.1 without SP1
vCenter Hyperic Server prior to 5.0.3
vCenter Hyperic Server 5.0.2 without SP1
vCenter Infrastructure Navigator prior to 5.8.3
vCenter Infrastructure Navigator prior to 5.7.1
vCenter Infrastructure Navigator prior to 2.0.1
vCenter Log Insight prior to 2.0.5
vCenter Log Insight prior to 2.0U1
vCenter Log Insight prior to 1.5.0U1
vCenter Operations Manager 5.x without patch
vCenter Orchestrator Appliance 5.5.x prior to 5.5.2.1
vCenter Orchestrator Appliance 5.1.x, 4.x without patch
vCenter Site Recovery Manager prior to 5.5.1.3
vCenter Site Recovery Manager prior to 5.1.2.2
vCenter Support Assistant without patch
vCloud Application Director 5.x, 6.x without patch
vCloud Automation Center 6.x without patch
vCloud Automation Center Application Services 6.x without patch
vCloud Director Appliance prior to 5.5.1.3
vCloud Connector prior to 2.6.1
vCloud Networking and Security prior to 5.5.3.1
vCloud Networking and Security prior to 5.1.4.3
vCloud Usage Meter prior to 3.3.2
vFabric Postgres prior to 9.3.5.1
vFabric Postgres prior to 9.2.9.1
vFabric Postgres prior to 9.1.14.1
VMware Application Dependency Planner prior to 2.0.0.1
View Planner prior to 3.0.1.1
VMware Data Recovery prior to 2.0.4
VMware HealthAnalyzer prior to 5.0.3.1
VMware Mirage Gateway prior to 5.1.1
VMware Socialcast On Premise prior to 2-116-1
VMware Socialcast On Premise prior to 2-112-1
VMware Studio 2.x without patch
VMware Workbench prior to 3.0.2
vSphere App HA prior to 1.1.1
vSphere App HA 1.1.0 without patch
vSphere Big Data Extensions 2.x without patch
vSphere Data Protection 5.x without patch
vSphere Management Assistant 5.5.x without 5.5 EP1
vSphere Management Assistant 5.1.x without 5.1.0.2
vSphere Management Assistant 5.0.x without 5.0 EP1
vSphere Replication prior to 5.8.0.1
vSphere Replication prior to 5.6.0.2
vSphere Replication prior to 5.5.1.3
vSphere Replication prior to 5.1.2.2
vSphere Storage Appliance prior to 5.5.2
vSphere Storage Appliance 5.1.x without patch

3. Problem Description
a. Bash update for multiple products.

Bash libraries have been updated in multiple products to resolve multiple critical security issues, also referred to as Shellshock.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 to these issues.

VMware products have been grouped into the following four product categories:

I) ESXi and ESX Hypervisor
ESXi is not affected because ESXi uses the Ash shell (through busybox), which is not affected by the vulnerability reported for the Bash shell. ESX has an affected version of the Bash shell.
See table 1 for remediation for ESX.

II) Windows-based products
Windows-based products, including all versions of vCenter Server running on Windows, are not affected.

III) VMware (virtual) appliances
VMware (virtual) appliances ship with an affected version of Bash.
See table 2 for remediation for appliances.

IV) Products that run on Linux, Android, OSX or iOS (excluding virtual appliances)
Products that run on Linux, Android, OSX or iOS (excluding virtual appliances) might use the Bash shell that is part of the operating system. If the operating system has a vulnerable version of Bash, the Bash security vulnerability might be exploited through the product. VMware recommends that customers contact their operating system vendor for a patch.

MITIGATIONS

VMware encourages restricting access to appliances through firewall rules and other network layer controls to only trusted IP addresses. This measure will greatly reduce any risk to these appliances.

RECOMMENDATIONS

VMware recommends customers evaluate and deploy patches for affected products in Table 1 and 2 below as these patches become available.

For several products, both a patch and a product update are available. In general, if a patch is made available, the patch must be applied to the latest version of the appliance.

Customers should refer to the specific product Knowledge Base articles listed in Section 4 to understand the type of remediation available and applicable appliance version numbers.

Column 4 of the following tables lists the action required to remediate the vulnerability in each release, if a solution is available.

Table 1 - ESXi and ESX Hypervisor

VMware Product Running Replace with/
Product Version on Apply Patch
===== ===== ====== ==================
ESXi

any

ESXi Not Affected
ESX 4.1 ESX ESX410-201410401-SG*
ESX 4.0 ESX ESX400-201410401-SG*

* VMware has made VMware ESX 4.0 and 4.1 security patches available for the Bash shell vulnerability. This security patch release is an exception to the existing VMware lifecycle Policy.

Table 2 - Products that are shipped as a (virtual) appliance.

VMware Product Running Replace with /
Product Version on Apply Patch
========== ===== ===== ==================
vCenter Server Appliance 5.x Linux 5.5 U2a, 5.1 U2b, 5.0 U3b
Horizon DaaS Platform 6.x Linux 6.1.1, 6.0.2, 5.4.3
Horizon Workspace 1.x, 2.x Linux See Section 4
IT Business Management Suite 1.x Linux 1.1.0, 1.0.1
NSX for Multi-Hypervisor

4.x

Linux 4.2.1, 4.1.4, 4.0.5
NSX for vSphere 6.x Linux 6.1.1, 6.0.7
NVP 3.x Linux 3.2.4
vCenter Converter Standalone 5.x Linux 5.5.3, 5.1.2**
vCenter Application Discovery Manager 7.x Linux See Section 4
vCenter Hyperic Server* 5.x Linux 5.8.3, 5.8.2-SP3, 5.8.1-SP3, 5.8.0-SP2, 5.7.2, 5.7.1-SP1, 5.0.3, 5.0.2-SP1
vCenter Infrastructure Navigator 5.x Linux 5.8.3, 5.7.1, 2.0.1
vCenter Log Insight 1.x, 2.x Linux 2.0.5, 2.0U1, 1.5.0U1
vCenter Operations Manager 5.x Linux See Section 4
vCenter Orchestrator Appliance* 4.x, 5.x Linux

5.5.2.1
5.1.2 and 4.2.3 - See Section 4

vCenter Site Recovery Manager 5.x Linux 5.5.1.3, 5.1.2.2, 5.0.x**
vCenter Support Assistant 5.x Linux See Section 4
vCloud Application Director 5.x, 6.x Linux See Section 4
vCloud Automation Center 6.x Linux See Section 4
vCloud Automation Center Application Services 6.x Linux See Section 4
vCloud Director Appliance 5.x Linux 5.5.1.3
vCloud Connector 2.x Linux 2.6.1
vCloud Networking and Security 5.x Linux 5.5.3.1, 5.1.4.3
vCloud Usage Meter 3.x Linux 3.3.2
vFabric Postgres 9.x Linux 9.3.5.1, 9.2.9.1, 9.1.14.1
View Planner 3.x Linux 3.0.1.1
VMware Application Dependency Planner x.x Linux 2.0.0.1
VMware Data Recovery 2.x Linux 2.0.4
VMware HealthAnalyzer 5.x Linux 5.0.3.1
VMware Mirage Gateway 5.x Linux 5.1.1
VMware Socialcast On Premise 2.x Linux 2-112-1, 2-116-1
VMware Studio 2.x Linux See Section 4
VMware Workbench 3.0.x Linux 3.0.2
vSphere App HA* 1.x Linux 1.1.1
vSphere Big Data Extensions 1.x, 2.x Linux See Section 4
vSphere Data Protection 5.x Linux See Section 4
vSphere Management Assistant 5.x Linux 5.5 EP1, 5.1.0.2, 5.0 EP1
vSphere Replication 5.x Linux 5.8.0.1, 5.6.0.2, 5.5.1.3, 5.1.2.2
vSphere Storage Appliance* 5.x Linux 5.5.2, 5.1.3 - See Section 4

* This product has patches available to update bash manually as well as a full installation that includes the bash fix for some versions. Either installing the patch or upgrading the appliance will remediate the "shellshock" vulnerability. See documentation in Section 4 for details.

** This product includes Virtual Appliances that will be updated, the product itself is not a Virtual Appliance.
4. Solution

ESX
Downloads:
https://www.vmware.com/patchmgr/findPatch.portal
Documentation:
http://kb.vmware.com/kb/2090859
http://kb.vmware.com/kb/2090853

vCenter Server Appliance
Downloads:
https://my.vmware.com/web/vmware/details?productId=353&downloadGroup=VC55U2
(scroll down to 5.5 Update 2a Appliance)
https://my.vmware.com/web/vmware/details?productId=285&downloadGroup=VCL-VSP510-VC-51U2A
(scroll down to 5.1 Update 2b Appliance)
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VC50U3A
(scroll down to 5.0 Update 3b Appliance)
Documentation:
http://kb.vmware.com/kb/2091085
http://kb.vmware.com/kb/2091018
http://kb.vmware.com/kb/2091017

Horizon DaaS Platform
Downloads:
https://my.vmware.com/web/vmware/details?productId=405&rPId=6527&downloadGroup=HORIZON-DAAS-610-BIN
https://my.vmware.com/web/vmware/details?productId=405&downloadGroup=HORIZON-DAAS-602
https://my.vmware.com/web/vmware/details?downloadGroup=HORIZON-DAAS-ONPREM-540&productId=398
Documentation:
http://kb.vmware.com/kb/2091183

Horizon Workspace
Downloads:
(Scroll down to the relevant download)
Workspace Portal 2.1.0 -> https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGroup=HZNP210
Workspace Portal 2.0.0 -> https://my.vmware.com/web/vmware/details?productId=419&rPId=6533&downloadGroup=HZNWS200
Horizon Workspace 1.8.2 -> https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGroup=HZNWS182
Horizon Workspace 1.8.1 -> https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGroup=HZNWS181
Horizon Workspace 1.8.0 -> https://my.vmware.com/web/vmware/details?productId=399&rPId=6083&downloadGroup=HZNWS180
Horizon Workspace 1.5.2 -> https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGroup=HZNWS152
Horizon Workspace 1.5.1 -> https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGroup=HZNWS151
Horizon Workspace 1.5.0 -> https://my.vmware.com/web/vmware/details?productId=350&rPId=4768&downloadGroup=HZNWS150
Documentation:
http://kb.vmware.com/kb/2091067

IT Business Management Suite
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-110&productId=384&rPId=6384
https://my.vmware.com/web/vmware/details?downloadGroup=ITBM-STD-101&productId=385&rPId=6333
Documentation:
http://kb.vmware.com/kb/2091014
http://kb.vmware.com/kb/2091013

NSX for Multi-Hypervisor
Downloads:
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-MH-421
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-MH-414
Note: For 4.0.5 refer to http://www.vmware.com/products/nsx
Documentation:
http://kb.vmware.com/kb/2091179
http://kb.vmware.com/kb/2091205

NSX for vSphere
Downloads:
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-V-611
https://my.vmware.com/group/vmware/get-download?downloadGroup=NSX-V-607  
Documentation:
http://kb.vmware.com/kb/2091213
http://kb.vmware.com/kb/2091216

vCenter Converter Standalone
Downloads:
https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_management/vmware_vcenter_converter_standalone/5_5
https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_management/vmware_vcenter_converter_standalone/5_1
Documentation:
http://kb.vmware.com/kb/2091104
http://kb.vmware.com/kb/2091102

NVP

Downloads and Documentation:
http://www.vmware.com/products/nsx

Application Discovery Manager
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VADM-700-VA&productId=300&rPId=3036

Documentation:
http://kb.vmware.com/kb/2092300

vCenter Hyperic Server
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCHQ_583_AGENT
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCHQ_583_SERVER
https://my.vmware.com/web/vmware/details?productId=378&rPId=6386&downloadGroup=VCHQ_582_SERVER
https://my.vmware.com/web/vmware/details?productId=378&rPId=6386&downloadGroup=VCHQ_581_SERVER
https://my.vmware.com/web/vmware/details?productId=378&rPId=6386&downloadGroup=VCHQ_580_SERVER
https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_572_AGENT
https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_572
https://my.vmware.com/web/vmware/details?productId=346&rPId=6849&downloadGroup=VFHQ_571
https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_503_AGENT
https://my.vmware.com/web/vmware/get-download?downloadGroup=VFHQ_503_SERVER
https://my.vmware.com/web/vmware/details?productId=311&rPId=6848&downloadGroup=VFHQ_502
Documentation:
http://kb.vmware.com/kb/2091109
http://kb.vmware.com/kb/2091210
http://kb.vmware.com/kb/2091372
http://kb.vmware.com/kb/2091373
http://kb.vmware.com/kb/2091206
http://kb.vmware.com/kb/2091223
http://kb.vmware.com/kb/2091207
http://kb.vmware.com/kb/2091224

vCenter Infrastructure Navigator
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VIN_583
https://my.vmware.com/web/vmware/get-download?downloadGroup=VIN_571
https://my.vmware.com/web/vmware/get-download?downloadGroup=VIN_201
Documentation:
http://kb.vmware.com/kb/2091095
http://kb.vmware.com/kb/2091093
http://kb.vmware.com/kb/2091108

vCenter Log Insight
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=STRATA20&productId=412&rPId=5804
https://my.vmware.com/group/vmware/details?downloadGroup=STRATA15&productId=386&rPId=4787
Documentation:
http://kb.vmware.com/kb/2091065
http://kb.vmware.com/kb/2091065

vCenter Log Insight
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=STRATA205&productId=412&rPId=6888
https://my.vmware.com/web/vmware/details?downloadGroup=STRATA20&productId=412&rPId=5804
https://my.vmware.com/web/vmware/details?downloadGroup=STRATA15&productId=386&rPId=4787
Documentation:
http://kb.vmware.com/kb/2091622
http://kb.vmware.com/kb/2091065

vCenter Operations Manager
Downloads:
https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGroup=VCOPS-583-STD
https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGroup=VCOPS-582-STD
https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGroup=VCOPS-581-STD
https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGroup=VCOPS-580-STD
https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGroup=VCOPS-573-STD
https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGroup=VCOPS-572-STD
https://my.vmware.com/web/vmware/details?productId=374&rPId=6725&downloadGroup=VCOPS-571-STD
https://my.vmware.com/web/vmware/details?productId=332&rPId=6743&downloadGroup=VCOPS-570-STD
Documentation:
http://kb.vmware.com/kb/2091083
http://kb.vmware.com/kb/2091002 (5.7.0, 5.7.1, 5.7.2, 5.7.3)
http://kb.vmware.com/kb/2091401 (5.8.0, 5.8.1, 5.8.2)

vCenter Orchestrator Appliance
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VCL_VCOVA_5521&productId=353&rPId=6655
Documentation:
http://kb.vmware.com/kb/2091036

vCenter Site Recovery Manager
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5513&productId=357&rPId=6636
https://my.vmware.com/web/vmware/details?downloadGroup=SRM5122&productId=291&rPId=6631
Documentation:
http://kb.vmware.com/kb/2091038
http://kb.vmware.com/kb/2091039
http://kb.vmware.com/kb/2091037 (5.0.x)

vCenter Support Assistant
Downloads and Documentation:
http://kb.vmware.com/kb/2091112

vCloud Application Director
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPDIR_601_GA&productId=383&rPId=6216
https://my.vmware.com/web/vmware/details?downloadGroup=VFAPPDIR_520_GA&productId=345&rPId=3789
Documentation:
http://kb.vmware.com/kb/2091129

vCloud Automation Center
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-610&productId=447&rPId=6501
https://my.vmware.com/web/vmware/details?downloadGroup=VCAC-6012&productId=383&rPId=6216
Documentation:
http://kb.vmware.com/kb/2091012

vCloud Automation Center Application Services
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=APPSER_610&productId=447&rPId=6501
Documentation:
http://kb.vmware.com/kb/2091129

vCloud Director Appliance
Downloads:
www.vmware.com/go/try-vcloud-director
Documentation:
http://kb.vmware.com/kb/2091071

vCloud Connector
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=VCC261-GA
Documentation:
http://kb.vmware.com/kb/2091045

vCloud Networking and Security
Downloads:
https://my.vmware.com/group/vmware/get-download?downloadGroup=VCNS5531
https://my.vmware.com/group/vmware/get-download?downloadGroup=VCNS5143
Documentation:
http://kb.vmware.com/kb/2091218
http://kb.vmware.com/kb/2091217

vCloud Usage Meter
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=UMSV332
Documentation:
http://kb.vmware.com/kb/2091184

vFabric Postgres
Downloads:
https://my.vmware.com/web/vmware/info/slug/application_platform/vmware_vfabric_postgres/9_3
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfabric_postgres/9_2
https://my.vmware.com/web/vmware/info?slug=application_platform/vmware_vfabric_postgres/9_1
Documentation:
http://kb.vmware.com/kb/2091055

View Planner
View Planner Benchmark Mode

Downloads:
https://my.vmware.com/web/vmware/details?productId=320&downloadGroup=VIEW-PLAN-300
Documentation:
http://kb.vmware.com/kb/2091281

View Planner Flexible Mode

Downloads and Documentation:
https://na6.salesforce.com/06980000001EUza

VMware Application Dependency Planner
Downloads and Documentation:
https://na6.salesforce.com/06980000001EUzQ

VMware Data Recovery

Downloads:
https://my.vmware.com/web/vmware/details?productId=229&downloadGroup=VDR204
Documentation:
http://kb.vmware.com/kb/2091015

VMware HealthAnalyzer
Downloads and Documentation:
https://na6.salesforce.com/06980000001EUzV

VMware Mirage Gateway

Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=MIRAGE-510&productId=407&rPId=6565
(See VMware Mirage Gateway Software)
Documentation:
http://kb.vmware.com/kb/2091090

VMware Socialcast On Premise
Downloads and Doumentation:
Please contact Global Support Services via My VMware

VMware Studio
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=STUDIO2600GA&productId=230
Documentation:
http://kb.vmware.com/kb/2091990

VMware Workbench
Downloads and Documentation:
https://developercenter.vmware.com/group/workbench/vm/3.0

vSphere App HA
Downloads:
https://my.vmware.com/web/vmware/get-download?downloadGroup=APPHA-111
https://my.vmware.com/web/vmware/details?downloadGroup=APPHA-110&productId=408&rPId=5635
Documentation:
http://kb.vmware.com/kb/2091087
http://kb.vmware.com/kb/2091371

vSphere Big Data Extensions
Downloads:
https://my.vmware.com/group/vmware/details?downloadGroup=BDE_200_GA&productId=353&rPId=6657
Documentation and Release Notes:
http://kb.vmware.com/kb/2091050
https://www.vmware.com/support/bigdataextensions/doc/vsphere-big-data-extensions-20-release-notes.html#resolvedissues
https://www.vmware.com/support/bigdataextensions/doc/vsphere-big-data-extensions-11-release-notes.html#resolvedissues
https://www.vmware.com/support/bigdataextensions/doc/vsphere-big-data-extensions-10-release-notes.html#resolvedissues

vSphere Data Protection
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VDP58_0&productId=353&rPId=6654
https://my.vmware.com/web/vmware/details?productId=353&rPId=6654&downloadGroup=VDP55_6
https://my.vmware.com/web/vmware/details?downloadGroup=VDPADV51_21&productId=330&rPId=3818
https://my.vmware.com/web/vmware/details?downloadGroup=VDP51_11&productId=285
Documentation:
http://kb.vmware.com/kb/2091341

vSphere Management Assistant

Downloads:
Download available via online vMA update mechanism and at:
https://my.vmware.com/web/vmware/details?productId=352&downloadGroup=VMA550
https://my.vmware.com/web/vmware/details?productId=285&downloadGroup=VSP510-VMA-510
https://my.vmware.com/web/vmware/details?productId=352&downloadGroup=VMA50
Documentation:
http://kb.vmware.com/kb/2079150
http://kb.vmware.com/kb/2079151

vSphere Replication
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VR5801&productId=353&rPId=6654
https://my.vmware.com/web/vmware/get-download?downloadGroup=VR5602
https://my.vmware.com/web/vmware/details?productId=353&rPId=5721&downloadGroup=VR5513
https://my.vmware.com/web/vmware/details?downloadGroup=VR5122&productId=285&rPId=6779
Documentation:
http://kb.vmware.com/kb/2091019
http://kb.vmware.com/kb/2091031
http://kb.vmware.com/kb/2091033
http://kb.vmware.com/kb/2091035

vSphere Storage Appliance
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VSP55-VSA-552&productId=354&rPId=6585
https://my.vmware.com/web/vmware/details?downloadGroup=VSP51-VSA-513&productId=297&rPId=3752
Documentation:
http://kb.vmware.com/kb/2091000
http://kb.vmware.com/kb/2091086

6. Change Log


2014-09-30 VMSA-2014-0010
Initial security advisory in conjunction with the release of vCenter Log Insight 2.0 U1 on 2014-09-30.

2014-10-01 VMSA-2014-0010.1
Updated advisory in conjunction with the release of ESX 4.x patches, vCenter Server Appliance 5.5 U2a, 5.1 U2b, and 5.0 U3b, vCloud Director Appliance 5.5.1.3, VMware Data Recovery 2.0.4, VMware Mirage Gateway 5.1.1 and vSphere Storage Appliance 5.5.2 on 2014-10-01. Added CVE-2014-6277 and CVE-2014-6278 as they have been confirmed to be mitigated.

2014-10-01 VMSA-2014-0010.2
Updated advisory in conjunction with the release of Horizon Workspace patches, IT Business Management Suite 1.1.0 and 1.0.1, vCenter Operations Manager patches, vCenter Site Recovery Manager 5.5.1.3 and 5.1.2.2, vCloud Application Director patches, vCloud Automation Center patches, vCloud Automation Center Application Services patches, vCloud Director Appliance 5.5.1.3, vFabric Postgres 9.3.5.1, 9.2.9.1, and 9.1.14.1, vSphere Replication 5.8.0.1, 5.5.1.3, and 5.1.2.2 on 2014-10-01.

2014-10-02 VMSA-2014-0010.3
Updated advisory in conjunction with the release of vCenter Hyperic Server 5.8.3, 5.7.2, and 5.0.3, vCenter Infrastructure Navigator 5.8.3, 5.7.1, and 2.0.1, vCenter Orchestrator Appliance patches, vCenter Support Assistant patches, vSphere App HA 1.1.1, vSphere Management Assistant 5.5 EP1 and 5.0 EP1, and vSphere Storage Appliance patches on 2014-10-02.

2014-10-02 VMSA-2014-0010.4
Updated advisory in conjunction with the release of Horizon DaaS Platform 6.1.1, 6.0.2, and 5.4.3, vCenter Orchestrator Appliance 5.5.2.1, vCloud Connector 2.6.1, vCloud Usage Meter 3.3.2, and vSphere Replication 5.6.0.2 on 2014-10-02.

2014-10-03 VMSA-2014-0010.5
Updated advisory in conjunction with the release of vCloud Networking and Security 5.5.3.1 and 5.1.4.3 on 2014-10-03.

2014-10-04 VMSA-2014-0010.6
Updated advisory in conjunction with the release of NSX for Multi-Hypervisor 4.2.1, 4.1.4, and 4.0.5, NSX for vSphere 6.1.1 and 6.0.7, NVP 3.2.4, and vSphere Big Data Extensions 2.x patch on 2014-10-04.

2014-10-05 VMSA-2014-0010.7
Updated advisory in conjunction with the release of View Planner Benchmark 3.0.1.1, and vSphere Data Protection 5.x patch on 2014-10-05.

2014-10-06 VMSA-2014-0010.8
Updated advisory in conjunction with the release of vCenter Hyperic Server 5.8.2 SP3, 5.8.1 SP3, 5.8.0 SP2, 5.7.1 SP1, and 5.0.2 SP1, vCenter Log Insight 1.5.0U1, View Planner Flexible 3.0.1.1, VMware Application Dependency Planner 2.0.0.1, VMware HealthAnalyzer 5.0.3.1, and vSphere App HA 1.1.0 patch on 2014-10-06.

2014-10-07 VMSA-2014-0010.9
Updated advisory in conjunction with the release of vCenter Operations Manager patches, VMware Socialcast On Premise 2-116-1 and 2-112-1, and vSphere Data Protection patches on 2014-10-07.

2014-10-08 VMSA-2014-0010.10
Updated advisory in conjunction with the release of vCenter Operations Manager patches on 2014-10-08.

2014-10-09 VMSA-2014-0010.11
Updated advisory in conjunction with the release of vCenter Converter Standalone 5.5.3 and 5.1.2, and vCenter Log Insight 2.0.5 on 2014-10-09.

2014-10-13 VMSA-2014-0010.12
Updated advisory in conjunction with the release of VMware Studio 2.x patch on 2014-10-13.

2014-10-17 VMSA-2014-0010.13
Updated advisory in conjunction with the release of vCenter Application Discovery Manager 7.0 patch, vSphere Management Assistant 5.1.0.2, and VMware Workbench 3.0.2 on 2014-10-17.

7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

 security-announce at lists.vmware.com
 bugtraq at securityfocus.com
 fulldisclosure at seclists.org

E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Advisories
http://www.vmware.com/security/advisories

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Policy
https://www.vmware.com/support/policies/lifecycle.html
 
Twitter
https://twitter.com/VMwareSRC

Copyright 2014 VMware Inc.  All rights reserved.