VMSA-2010-0005 VMware products address vulnerabilities in WebAccess

               VMware Security Advisory

A cross-site scripting vulnerability in WebAccess allows for
disclosure of sensitive information. The flaw is due to insufficient
verification of certain parameters which may lead to redirection of
a user&#39;s requests.

This vulnerability can only be exploited if the attacker tricks the
WebAccess user into clicking a malicious link and the attacker has
control of a server on the same network as the system where
WebAccess is being used.

Workaround
By switching off WebAccess the issue can no longer be exploited.
This can be accomplished on affected versions of Virtual Center and
ESX as follows:

Virtual Center 2.0.2 and Virtual Center 2.5:
  Go to the Windows Services overview on the system that runs
  Virtual Center.
  To stop WebAccess without a reboot:
     Change the status of the VMware Infrastructure Web Access
     service to stop
  To prevent WebAccess from starting after the next reboot:
     Change the startup type of the VMware Infrastructure Web
     Access service to disabled

ESX 3.0.3 and ESX 3.5:
  Open a root shell on ESX.
  To stop WebAccess without a reboot:
     service vmware-webAccess stop
  To prevent WebAccess from starting after the next reboot:
     chkconfig vmware-webAccess off

VMware would like to thank David Byrne and Tom Leavey of Trustwave&#39;s
SpiderLabs for reporting this issue to us.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the name CVE-2009-2277 to this issue.

The following table lists what action remediates the vulnerability
&#40;column 4&#41; if a solution is available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        4.0       Windows  not affected
VirtualCenter  2.5       Windows  Virtual Center 2.5 Update 6
VirtualCenter  2.0.2     Windows  not being fixed at this time *

hosted **      any       any      not affected    

ESXi           any       ESXi     not affected

ESX            4.0       ESX      not affected
ESX            3.5       ESX      ESX350-201003403-SG
ESX            3.0.3     ESX      not being fixed at this time *
ESX            2.5.5     ESX      not affected

vMA            4.0       RHEL5    not affected

Note: This vulnerability can be exploited remotely only if the
      attacker has access to the Service Console network.

      Security best practices provided by VMware recommend that the
      Service Console be isolated from the VM network. Please see
      http://www.vmware.com/resources/techresources/726 for more
      information on VMware security best practices.

A cross-site scripting vulnerability allows for execution of
JavaScript in the Web browser&#39;s security context for WebAccess. The
flaw is due to insufficient checking on the names of virtual
machines.

In order to exploit the issue, the attacker must have control over
the naming of a virtual machine and must have the user list this
Virtual Machine in WebAccess.

Workaround
By switching off WebAccess the issue can no longer be exploited. See
section 3.a on how this can be accomplished.

VMware would like to thank Craig Marshall of Ernst and Young
Advanced Security Center for reporting this issue to us.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the name CVE-2010-1137 to this issue.

The following table lists what action remediates the vulnerability
&#40;column 4&#41; if a solution is available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        4.0       Windows  not affected
VirtualCenter  2.5       Windows  Virtual Center 2.5 Update 4 *
VirtualCenter  2.0.2     Windows  not being fixed at this time **

Workstation    any       any      not affected

Player         any       any      not affected

Server         2.0       any      not affected
Server         1.0       any      not being fixed at this time ***

ACE            any       any      not affected

Fusion         any       any      not affected

ESXi           any       ESXi     not affected

ESX            4.0       ESX      not affected
ESX            3.5       ESX      ESX350-200903223-UG *
ESX            3.0.3     ESX      not being fixed at this time **
ESX            2.5.5     ESX      not affected

vMA            4.0       RHEL5    not affected

Note: This vulnerability can be exploited remotely only if the
      attacker has access to the Service Console network.

      Security best practices provided by VMware recommend that the
      Service Console be isolated from the VM network. Please see
      http://www.vmware.com/resources/techresources/726 for more
      information on VMware security best practices.

The WebAccess component doesn&#39;t sufficiently validate user supplied
input and allows for forwarding of an incoming request to another
destination. The destination will not be able to see the true origin
of the request URL but instead will see the address of the machine
that runs WebAccess. An attacker could use the forwarding
vulnerability to direct traffic at servers while disguising the
source location.

The security issue is limited to URL forwarding. This vulnerability
doesn&#39;t allow for a so-called cross-site scripting attack and
doesn&#39;t allow for stealing of the user cookies.

Workaround
By switching off WebAccess the issue can no longer be exploited. See
section 3.a on how this can be accomplished.

VMware would like to thank John Fitzpatrick of MWR InfoSecurity
for reporting this issue to us.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the name CVE-2010-0686 to this issue.

The following table lists what action remediates the vulnerability
&#40;column 4&#41; if a solution is available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        4.0       Windows  not affected
VirtualCenter  2.5       Windows  not being fixed at this time *
VirtualCenter  2.0.2     Windows  not being fixed at this time *

Workstation    any       any      not affected

Player         any       any      not affected

Server         2.0       any      not being fixed at this time *
Server         1.0       any      not affected

ACE            any       any      not affected

Fusion         any       any      not affected

ESXi           any       ESXi     not affected

ESX            4.0       ESX      not affected
ESX            3.5       ESX      not being fixed at this time *
ESX            3.0.3     ESX      not being fixed at this time *
ESX            2.5.5     ESX      not affected

vMA            4.0       RHEL5    not affected

   Security best practices provided by VMware recommend that the
   Service Console be isolated from the VM network. Please see
   http://www.vmware.com/resources/techresources/726 for more
   information on VMware security best practices.

A cross-site scripting vulnerability allows for execution of
JavaScript in the Web browser&#39;s security context for WebAccess. The
flaw is due to incorrect parsing of JSON error messages.

This vulnerability can only be exploited if the attacker tricks the
WebAccess user into clicking a malicious link.

Workaround
By switching off WebAccess the issue can no longer be exploited. See
section 3.a on how this can be accomplished.

VMware would like to thank Nathan Keltner for reporting this issue
to us.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the name CVE-2010-1193 to this issue.

The following table lists what action remediates the vulnerability
&#40;column 4&#41; if a solution is available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
vCenter        4.0       Windows  not affected
VirtualCenter  2.5       Windows  not affected
VirtualCenter  2.0.2     Windows  not affected

Workstation    any       any      not affected

Player         any       any      not affected

Server         2.0       any      not being fixed at this time *
Server         1.0       any      not affected

ACE            any       any      not affected

Fusion         any       any      not affected

ESXi           any       ESXi     not affected

ESX            4.0       ESX      not affected
ESX            3.5       ESX      not affected
ESX            3.0.3     ESX      not affected
ESX            2.5.5     ESX      not affected

vMA            4.0       RHEL5    not affected

VMSA-2010-0005 VMware products address vulnerabilities in WebAccess

VMware Virtual Center 2.5 Update 6

ESX 3.5

Related