Detections
Analytics

VMSA-2014-0008 : VMware vSphere product updates to third-party libraries

high Nessus Plugin ID 77630

Language:

Synopsis

The remote VMware ESXi host is missing a security-related patch.

Description

a. vCenter Server Apache Struts Update

 The Apache Struts library is updated to address a security issue.

This issue may lead to remote code execution after authentication.

 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2014-0114 to this issue.


b. vCenter Server tc-server 2.9.5 / Apache Tomcat 7.0.52 updates

 tc-server has been updated to version 2.9.5 to address multiple security issues. This version of tc-server includes Apache Tomcat 7.0.52.

 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2013-4590, CVE-2013-4322, and CVE-2014-0050 to these issues.

c. Update to ESXi glibc package

 glibc is updated to address multiple security issues.

 The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2013-0242 and CVE-2013-1914 to these issues.

d. vCenter and Update Manager, Oracle JRE 1.7 Update 55

 Oracle has documented the CVE identifiers that are addressed in JRE 1.7.0 update 55 in the Oracle Java SE Critical Patch Update Advisory of April 2014. The References section provides a link to this advisory.

Solution

Apply the missing patch.

See Also

http://lists.vmware.com/pipermail/security-announce/2014/000282.html

Plugin Details

Severity: High

ID: 77630

File Name: vmware_VMSA-2014-0008.nasl

Version: 1.30

Type: local

Published: 9/11/2014

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:vmware:esxi:5.1, cpe:/o:vmware:esxi:5.5

Required KB Items: Host/local_checks_enabled, Host/VMware/release, Host/VMware/version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/9/2014

Exploitable With

Metasploit (Apache Struts ClassLoader Manipulation Remote Code Execution)

Reference Information

CVE: CVE-2013-0242, CVE-2013-1914, CVE-2013-4322, CVE-2013-4590, CVE-2014-0050, CVE-2014-0114

BID: 57638, 58839, 63676, 64493, 65400, 65568, 65767, 65768, 66856, 66866, 66870, 66873, 66877, 66879, 66881, 66883, 66886, 66887, 66891, 66893, 66894, 66897, 66898, 66899, 66902, 66903, 66904, 66905, 66907, 66908, 66909, 66910, 66911, 66912, 66913, 66914, 66915, 66916, 66917, 66918, 66919, 66920, 67121

VMSA: 2014-0008