This is the third update to a original that was released in March 2014, it relates to a potential DDOS in a subcommand of NTP and a security issue in GLIB.
|Synopsis:||VMware vSphere updates to third party libraries|
|CVE numbers:||NTP:- CVE-2013-5211
glibc (service console): – CVE-2013-4332
JRE:- See References
VMware has updated vSphere third party libraries.
- vCenter Server Appliance 5.5 prior to 5.5 Update 1
- VMware vCenter Server 5.5 prior 5.5 Update 1
- VMware Update Manager 5.5 prior 5.5 Update 1
- VMware ESXi 5.5 without patch ESXi550-201403101-SG
- VMware ESXi 5.1 without patch ESXi510-201404101-SG
- VMware ESXi 5.0 without patch ESXi500-201405102-SG
- VMware ESXi 4.1 without patch ESXi410-201404401-SG
- VMware ESXi 4.0 without patch ESXi400-201404401-SG
- VMware ESX 4.1 without patch ESX410-201404402-SG
- VMware ESX 4.0 without patch ESX400-201404402-SG
a. DDoS vulnerability in NTP third party libraries:
The NTP daemon has a DDoS vulnerability in the handling of the “monlist” command. An attacker may send a forged request to a vulnerable NTP server resulting in an amplified response to the intended target of the DDoS attack.
Mitigation for this issue is documented in VMware Knowledge Base article 2070193. This article also documents when vSphere products are affected.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-5211 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
|VMware Product||VMware Version||Running on||Replace with/Apply Patch|
|VCSA||5.5||Linux||5.5 Update 1|
b. Update to ESXi glibc package
The ESXi glibc package is updated to version glibc-2.5-118.el5_10.2 to resolve a security issue.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-4332 to this issue.
|VMware Product||Product Version||Running on||Replace with/Apply Patch|
|ESXi||4.1||ESXi||No Patch Planned|
|ESXi||4.0||ESXi||No Patch Planned|
c. vCenter and Update Manager, Oracle JRE 1.7 Update 45:
Oracle JRE is updated to version JRE 1.7 Update 45, which addresses multiple security issues that existed in earlier releases of Oracle JRE.
Oracle has documented the CVE identifiers that are addressed in JRE 1.7.0 update 45 in the Oracle Java SE Critical Patch Update Advisory of October 2013. The References section provides a link to this advisory.
|VMware Product||Product Version||Running on||Replace with/Apply patch|
|vCenter Server||5.5||Any||5.5 Update 1|
|vCenter Server||5.1||Any||Not Applicable **|
|vCenter Server||5.0||Any||Not Applicable **|
|vCenter Server||4.1||Windows||Not Applicable **|
|vCenter Server||4.0||Windows||Not Applicable *|
|Update Manager||5.5||Windows||5.5 Update 1|
|Update Manager||5.1||Windows||Not Applicable **|
|Update Manager||5.0||Windows||Not Applicable **|
|Update Manager||4.1||Windows||Not Applicable *|
|Update Manager||4.0||Windows||Not Applicable *|
|ESX||4.1||ESX||Not Applicable **|
|ESX||4.0||ESX||Not Applicable *|
* this product uses the Oracle JRE 1.5.0 family
** this product uses the Oracle JRE 1.6.0 family
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
- vCenter Server 5.5
- ESXi 5.5
update-from-esxi5.5-5.5_update01 contains ESXi550-201403101-SG
- ESXi 5.0
ESXi500-201405001 contains ESXi500-201405102-SG
- ESXi 5.1
ESXi510-201404001 contains ESXi510-201404101-SG
- ESXi 4.1
ESXi410-201403001.zip contains ESXi410-201404401-SG
- ESXi 4.0
ESXi400-201404001.zip contains ESXi400-201404401-SG
- ESX 4.1
ESX410-201404001.zip contains ESX410-201404402-SG
- ESX 4.0
ESX400-201404001.zip contains ESX400-201404402-SG
——— jre ———
Oracle Java SE Critical Patch Update Advisory of October 2013: – http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
VMware Knowledge Base article 2070193: – http://kb.vmware.com/kb/2070193
2014-03-11 VMSA-2014-0002: – Initial security advisory in conjunction with the release of vSphere 5.5 Update 1 on 2014-03-11
2014-04-10 VMSA-2014-0002.1: – Updated security advisory in conjunction with the release of ESXi/ESX 4.0 and 4.1 patches on 2014-04-10
2014-04-29 VMSA-2014-0002.2: – Updated security advisory in conjunction with the release of ESXi 5.1 patches on 2014-04-29
2014-05-29 VMSA-2014-0002.3: – Updated security advisory in conjunction with the release of ESXi 5.0 patches on 2014-05-29
E-mail list for product security notifications and announcements:http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories: – http://www.vmware.com/security/advisories
VMware Security Response policy: – http://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases: – https://www.vmware.com/support/policies/lifecycle.html
Twitter: – https://twitter.com/VMwareSRC
Copyright 2014 VMware Inc. All rights reserved.