VMSA-2016-0013

VMware Identity Manager and vRealize Automation updates address multiple security issues

VMware Security Advisory
 
VMware Security Advisory Advisory ID:
 VMSA-2016-0013
VMware Security Advisory Severity:
 Important
VMware Security Advisory Synopsis:
 VMware Identity Manager and vRealize Automation updates address multiple security issues
VMware Security Advisory Issue date:
 2016-08-23
VMware Security Advisory Updated on:
 2016-08-23 (Initial Advisory)
VMware Security Advisory CVE numbers:
 CVE-2016-5335, CVE-2016-5336
 
1. Summary

VMware Identity Manager and vRealize Automation updates address multiple security issues

 
2. Relevant Products
  • VMware Identity Manager
  • vRealize Automation
  •  
3. Problem Description

a. VMware Identity Manager local privilege escalation vulnerability  

 

VMware Identity Manager and vRealize Automation both contain a vulnerability that may allow for a local privilege escalation. Exploitation of this issue may lead to an attacker with access to a low-privileged account to escalate their privileges to that of root.  

 

The Common Vulnerabilities and Exposures project (cve.mitre.org) has reserved the identifier CVE-2016-5335 for this issue.  

 

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

 

VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch*
Workaround
VMware Product VMware Identity Manager
Product Version 2.x
Running on VA
Severity Important
Replace with/ Apply Patch* 2.7
Workaround None
VMware Product vRealize Automation
Product Version 7.0.x
Running on VA
Severity Important
Replace with/ Apply Patch* 7.1
Workaround None
VMware Product vRealize Automation
Product Version 6.x
Running on 6.x
Severity N/A
Replace with/ Apply Patch* not affected
Workaround N/A

 

b. vRealize Automation remote code execution vulnerability      

 

vRealize Automation contains a vulnerability that may allow for remote code execution. Exploitation of this issue may lead to an attacker gaining access to a low-privileged account on the appliance.     

 

The Common Vulnerabilities and Exposures project (cve.mitre.org) has reserved the identifier CVE-2016-5336 for this issue. 

 

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch*
Workaround
VMware Product vRealize Automation
Product Version 7.0.x
Running on VA
Severity Important
Replace with/ Apply Patch* 7.1
Workaround KB2146585
VMware Product vRealize Automation
Product Version 6.x
Running on VA
Severity N/A
Replace with/ Apply Patch* not affected
Workaround N/A

 

 

4. Solution

 

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

VMware Identity Manager 2.7

-------------------------------------------

Downloads and Documentation     

 

vRealize Automation 7.1  

----------------------------------

Downloads and Documentation

 

5. References

 

          http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5335 

          http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5336

          https://kb.vmware.com/kb/2146585

 

6. Change log

 

2016-08-23 VMSA-2016-0013 Initial security advisory in conjunction with the release of vRealize Automation 7.1 on 2016-08-23.

 

7. Contact

 

E-mail list for product security notifications and announcements:

http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

 

This Security Advisory is posted to the following lists:

security-announce@lists.vmware.com

bugtraq@securityfocus.com

fulldisclosure@seclists.org

 

E-mail: security@vmware.com

PGP key at: https://kb.vmware.com/kb/1055

 

VMware Security Advisories

http://www.vmware.com/security/advisories

 

 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html

 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html

 

Twitter

https://twitter.com/VMwareSRC

 

Copyright 2016 VMware Inc. All rights reserved.

Sign up for Security Advisories