Summary
VMware has updated vSphere third party libraries.
Solution
Apply the missing patch(es).
Insight
a. DDoS vulnerability in NTP third party libraries
The NTP daemon has a DDoS vulnerability in the handling of the "monlist" command. An attacker may send a forged request to a vulnerable NTP server resulting in an amplified response to the intended target of the DDoS attack.
b. Update to ESXi glibc package
The ESXi glibc package is updated to version glibc-2.5-118.el5_10.2 to resolve a security issue.
c. vCenter and Update Manager, Oracle JRE 1.7 Update 45
Oracle JRE is updated to version JRE 1.7 Update 45, which addresses multiple security issues that existed in earlier releases of Oracle JRE.
Affected
vCenter Server Appliance 5.5 prior to 5.5 Update 1 VMware vCenter Server 5.5 prior 5.5 Update 1
VMware Update Manager 5.5 prior 5.5 Update 1
VMware ESXi 5.5 without patch ESXi550-201403101-SG
Detection
Checks for missing patches.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2013-4332, CVE-2013-5211 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
Related Vulnerabilities
- VMSA-2014-0005: VMware Workstation, Player, Fusion, and ESXi patches address a guest privilege escalation
- VMSA-2014-0002 VMware vSphere updates to third party libraries
- VMSA-2014-0006: VMware product updates address OpenSSL security vulnerabilities
- VMSA-2014-0012: VMware vSphere product updates address security vulnerabilities
- VMSA-2014-0001 VMware Workstation, Player, Fusion, ESXi, ESX and vCloud Director address several security issues