VMSA-2015-0009 : VMware product updates address a critical deserialization vulnerability

VMware Security Advisory
Advisory ID: VMSA-2015-0009
Synopsis: VMware product updates address a critical deserialization vulnerability
Issue date: 2015-12-18
Updated on: 2015-12-18 (Initial Advisory)
CVE numbers: CVE-2015-6934
1. Summary
VMware product updates address a critical deserialization vulnerability
2. Relevant Releases
vRealize Orchestrator 6.x
vCenter Orchestrator 5.x
3. Problem Description
Deserialization vulnerability

A deserialization vulnerability involving Apache Commons-collections and a specially constructed chain of classes exists. Successful exploitation could result in remote code execution, with the permissions of the application using the Commons-collections library.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-6934 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available

VMware Product Running Replace with/
Product Version on Apply Patch**
vRealize Orchestrator 7.0 Any Not Affected
vRealize Orchestrator 6.x Any KB2141244
vCenter Orchestrator 5.x Any KB2141244
vRealize Operations 6.x Windows Patch Pending *
vCenter Operations 5.x Windows Patch Pending *
vCenter Application Discovery Manager (vADM) 7.x Any Patch Pending

* Exploitation of the issue on vRealize Operations and vCenter Operations is limited to local privilege escalation.

4. Solution
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.vRealize Orchestrator 6.x and vCenter Orchestrator 5.x
Downloads and Documentation: http://kb.vmware.com/kb/2141244

6. Change log
2015-12-18 VMSA-2015-0009 Initial security advisory in conjunction with the release of vRealize Orchestrator 6.x and vCenter Orchestrator 5.x patches on 2015-12-18.

Created on December 18, 2015 by Rick Scherer

Posted under Alert.

This blog has 33,352 views.

Tags: , , , ,

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

Leave a Comment

Name (required)

Email (required)

Website

Comments

More Blog Post