VMSA-2014-0008 : VMware vSphere product updates to third-party libraries

This script is Copyright (C) 2014-2016 Tenable Network Security, Inc.


Synopsis :

The remote VMware ESXi host is missing a security-related patch.

Description :

a. vCenter Server Apache Struts Update

The Apache Struts library is updated to address a security issue.

This issue may lead to remote code execution after authentication.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifier CVE-2014-0114 to this issue.


b. vCenter Server tc-server 2.9.5 / Apache Tomcat 7.0.52 updates

tc-server has been updated to version 2.9.5 to address multiple
security issues. This version of tc-server includes Apache Tomcat
7.0.52.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifiers CVE-2013-4590, CVE-2013-4322, and
CVE-2014-0050 to these issues.

c. Update to ESXi glibc package

glibc is updated to address multiple security issues.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the identifiers CVE-2013-0242 and CVE-2013-1914 to
these issues.

d. vCenter and Update Manager, Oracle JRE 1.7 Update 55

Oracle has documented the CVE identifiers that are addressed in
JRE 1.7.0 update 55 in the Oracle Java SE Critical Patch Update
Advisory of April 2014. The References section provides a link to
this advisory.

See also :

http://lists.vmware.com/pipermail/security-announce/2014/000282.html

Solution :

Apply the missing patch.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.9
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true