VMSA-2014-0002 : VMware vSphere updates to third-party libraries

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote VMware ESXi / ESX host is missing one or more
security-related patches.

Description :

a. DDoS vulnerability in NTP third-party libraries

The NTP daemon has a DDoS vulnerability in the handling of the
'monlist' command. An attacker may send a forged request to a
vulnerable NTP server resulting in an amplified response to the
intended target of the DDoS attack.

Mitigation

Mitigation for this issue is documented in VMware Knowledge Base
article 2070193. This article also documents when vSphere
products are affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-5211 to this issue.

b. Update to ESXi glibc package

The ESXi glibc package is updated to version
glibc-2.5-118.el5_10.2 to resolve a security issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-4332 to this issue.

c. vCenter and Update Manager, Oracle JRE 1.7 Update 45

Oracle JRE is updated to version JRE 1.7 Update 45, which
addresses multiple security issues that existed in earlier
releases of Oracle JRE.

Oracle has documented the CVE identifiers that are addressed
in JRE 1.7.0 update 45 in the Oracle Java SE Critical Patch
Update Advisory of October 2013. The References section provides
a link to this advisory.

See also :

http://lists.vmware.com/pipermail/security-announce/2014/000246.html

Solution :

Apply the missing patches.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.3
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true