20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

GLSA-201502-12

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

68626

1030577

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

oracle-cpujul2014-cve20144247(94592)

The remote host is affected by the vulnerability described in GLSA-201502-12 (Oracle JRE/JDK: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Oracle&rsquo;s Java SE       Development Kit and Runtime Environment. Please review the CVE       identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       disclose, update, insert, or delete certain data.
  Workaround :

    There is no known workaround at this time.

The VMware vCenter Server installed on the remote host is version 5.0 prior to Update 3c, 5.1 prior to Update 3, or 5.5 prior to Update 2.
It is, therefore, affected by multiple vulnerabilities in third party libraries :

  - Due to improper certificate validation when connecting     to a CIM server on an ESXi host, an attacker can     perform man-in-the-middle attacks. (CVE-2014-8371)

  - The bundled version of Oracle JRE is prior to 1.6.0_81     and thus is affected by multiple vulnerabilities. Note     that this only affects version 5.1 and 5.0 of vCenter     but is only fixed in 5.1 Update 3.

The version of VMware vCenter Update Manager installed on the remote Windows host is 5.1 prior to Update 3. It is, therefore, affected by multiple vulnerabilities related to the bundled version of Oracle JRE prior to 1.6.0_81.

According to its self-reported version number, the Puppet Enterprise application installed on the remote host is version 3.3.0. Therefore, it contains a bundled version of Oracle Java that is affected by multiple vulnerabilities.

This Critical Patch Update contains 20 new security fixes for Oracle Java SE. All of these vulnerabilities could have been remotely exploitable without authentication, i.e., could be exploited over a network without the need for a username and password.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 8 Update 11, 7 Update 65, 6 Update 81, or 5 Update 71. It is, therefore, affected by security issues in the following components :

  - Deployment
  - Hotspot
  - JavaFX
  - JMX
  - Libraries
  - Security
  - Serviceability
  - Swing

ID	Name	Product	Family	Severity
81370	GLSA-201502-12 : Oracle JRE/JDK: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
79865	VMware Security Updates for vCenter Server (VMSA-2014-0012)	Nessus	Misc.	critical
79864	VMware vCenter Update Manager Multiple Java Vulnerabilities (VMSA-2014-0012)	Nessus	Windows	critical
77282	Puppet Enterprise 3.3.0 Bundled Oracle Java Vulnerabilities	Nessus	CGI abuses	critical
76998	SuSE 11.3 Security Update : openjdk (SAT Patch Number 9543)	Nessus	SuSE Local Security Checks	critical
76533	Oracle Java SE Multiple Vulnerabilities (July 2014 CPU) (Unix)	Nessus	Misc.	critical
76532	Oracle Java SE Multiple Vulnerabilities (July 2014 CPU)	Nessus	Windows	critical

CVE-2014-4247

HIGH

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical