Documents Associated to Virtual Appliance

New User, Welcome! Login

Virtual Appliance

VMSA-2010-0011 VMware Studio 2.1 addresses security vulnerabilities in virtual appliances created with Studio 2.0.

- ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2010-0011
Synopsis:          VMware Studio 2.1 addresses security vulnerabilities
                   in virtual appliances created with Studio 2.0.
Issue date:        2010-07-13
Updated on:        2010-07-13 (initial release of advisory)
CVE numbers:       CVE-2010-2427 CVE-2010-2667
- ------------------------------------------------------------------------

VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues

   VMware Workstation for Windows 32-bit and 64-bit without tools
   md5sum: 6a18ea3847cb727b03f7890f5643db79
   sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984

   ACE Management Server Virtual Appliance
   md5sum: e26d258c511572064e99774fbac9184c
   sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5

   ACE Management Server for Windows
   md5sum: e970828f2a5a62ac108879033a70f4b6

VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues

   VMware Workstation for Windows 32-bit and 64-bit without tools
   md5sum: 6a18ea3847cb727b03f7890f5643db79
   sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984

   ACE Management Server Virtual Appliance
   md5sum: e26d258c511572064e99774fbac9184c
   sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5

   ACE Management Server for Windows
   md5sum: e970828f2a5a62ac108879033a70f4b6

VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues.

   ----------------
   http://www.vmware.com/download/ace/
   Release notes 2.0:
   http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html

   ACE Manager Server Virtual Appliance
   Virtual Appliance for the ACE Management Server
   md5sum: 41e7349f3b6568dffa23055bb629208d

   ACE for Window 32-bit and 64-bit
   Main installation file for Windows 32-bit and 64-bit host (ACE Option

VMSA-2008-0016 VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues

   ----------------
   http://www.vmware.com/download/ace/
   Release notes 2.0:
   http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html

   ACE Manager Server Virtual Appliance
   Virtual Appliance for the ACE Management Server
   md5sum: 41e7349f3b6568dffa23055bb629208d

   ACE for Window 32-bit and 64-bit
   Main installation file for Windows 32-bit and 64-bit host (ACE Option

VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues

   ----------------
   http://www.vmware.com/download/ace/
   Release notes:
   http://www.vmware.com/support/ace25/doc/releasenotes_ace252.html

   ACE Management Server Virtual Appliance
   AMS Virtual Appliance .zip
   md5sum: 430ff7792d9d490d1678fc22b4c62121
   sha1sum: 98b74e0dba4214b055c95ccea656bfa2731c3fee

   VMware ACE for Windows 32-bit and 64-bit

VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server

   ----------------
   http://www.vmware.com/download/ace/
   Release notes:
   http://www.vmware.com/support/ace25/doc/releasenotes_ace253.html

   ACE Management Server Virtual Appliance
   AMS Virtual Appliance .zip
   md5sum: 44cc7b86353047f02cf6ea0653e38418
   sha1sum: 9f44b15e6681a6e58dd20784f829c68091a62cd1

   VMware ACE for Windows 32-bit and 64-bit

VMSA-2009-0006 VMware Hosted products and patches for ESX and ESXi resolve a critical security vulnerability

   ----------------
   http://www.vmware.com/download/ace/
   Release notes:
   http://www.vmware.com/support/ace25/doc/releasenotes_ace252.html
 
   ACE Management Server Virtual Appliance
   AMS Virtual Appliance .zip
   md5sum: 430ff7792d9d490d1678fc22b4c62121
   sha1sum: 98b74e0dba4214b055c95ccea656bfa2731c3fee
 
   VMware ACE for Windows 32-bit and 64-bit

VMSA-2009-0015 VMware hosted products and ESX patches resolve two security issues

   ----------------
   http://www.vmware.com/download/ace/
   Release notes:
   http://www.vmware.com/support/ace25/doc/releasenotes_ace253.html

   ACE Management Server Virtual Appliance
   AMS Virtual Appliance .zip
   md5sum: 44cc7b86353047f02cf6ea0653e38418
   sha1sum: 9f44b15e6681a6e58dd20784f829c68091a62cd1

   VMware ACE for Windows 32-bit and 64-bit

VMSA-2009-0012 VMware Movie Decoder, VMware Workstation, VMware Player, and VMware ACE resolve security issues.

   ----------------
   http://www.vmware.com/download/ace/
   Release notes:
   http://www.vmware.com/support/ace25/doc/releasenotes_ace253.html

   ACE Management Server Virtual Appliance
   AMS Virtual Appliance .zip
   md5sum: 44cc7b86353047f02cf6ea0653e38418
   sha1sum: 9f44b15e6681a6e58dd20784f829c68091a62cd1

   VMware ACE for Windows 32-bit and 64-bit

VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues

   ----------------
   http://www.vmware.com/download/ace/
   Release notes:
   http://www.vmware.com/support/ace25/doc/releasenotes_ace252.html

   ACE Management Server Virtual Appliance
   AMS Virtual Appliance .zip
   md5sum: 430ff7792d9d490d1678fc22b4c62121
   sha1sum: 98b74e0dba4214b055c95ccea656bfa2731c3fee

   VMware ACE for Windows 32-bit and 64-bit

MVSA-10-006 / CVE-2010-0153 - IBM Proventia Network Mail Security System - Cross-Site Request Forgery vulnerabilities

Web-based Local Management Interface (LMI) of IBM Proventia Network Mail Security System appliance (firmware 1.6 and 2.5) is vulnerable to XSRF attacks. When exploited by an attacker, the identified vulnerabilities could lead to compromising the security of the appliance, including unauthorized alteration of appliance's settings, DoS attacks, etc.


Affected Versions

IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
IBM Proventia Network Mail Security System - virtual appliance (firmware 2.5)


Mitigation

MVSA-10-007 / CVE-2010-0152 - IBM Proventia Mail Security System - Multiple persistent and reflected XSS vulnerabilities

        url_placeholder/sla/index.php?l="><script>alert(document.cookie)</script>


Affected Versions

IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)
IBM Proventia Network Mail Security System - virtual appliance (firmware 2.5)


Mitigation

MVSA-10-009 / CVE-2010-0155 - IBM Proventia Network Mail Security System - CRLF Injection vulnerability

        url_placeholder/load.php?browVerOK=true&browVerPerfect=false&javaVersion=any%0D%0ALocation:     %20http://www.google.com%0D%0A&javaVendor=Sun%20Microsystems        %20Inc.&javaEnabled=true&welcome=true&detectionFlag=1&popupBlocked=no


Affected Versions

IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)


Mitigation
    
Vendor recommends upgrading to PNMSS firmware 2.5 or later.

VMSA-2009-0011 VMware Studio 2.0 addresses a security issue in the public beta version of Studio 2.0

 a. Directory traversal vulnerability

    Due to incomplete sanitation of user input, a support component of
    VMware Studio's web interface can be tricked into uploading a file
    to any directory inside the VMware Studio virtual appliance.  This
    issue does not affect virtual machines that are created with Studio
    2.0 beta.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2009-2968 to this issue.

MVSA-10-008 / CVE-2010-0154 - IBM Proventia Mail Security System - Insecure Direct Object Reference vulnerability

                url_placeholder/sla/index.php?l=/../../../../../../../../etc/php.ini


Affected Versions

IBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)


Mitigation
    
Vendor recommends upgrading to PNMSS firmware 2.5 or later.

Citrix XenCenterWeb Multiple Vulnerabilities

Due to poor validation of some user controlled inputs, a variety of attacks 
against the application and the underlying server are possible.
Cross-site scripting, cross-site request forgery, SQL injection and remote 
command execution attack vectors were identified as well. 

XSS and CSRF attacks can be performed on the virtual appliance itself, while 
the others require the PHP parameter magic_quotes_gpc to be off on the web 
server.

*** VULNERABILITY DETAILS ***

[TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - see details)

~~~~~~~~~~~~~
IBM Internet Security Systems (ISS) offers a comprehensive portfolio 
of IT security products and services for organizations of all sizes. 

IBM Proventia Network Mail Security System and IBM Proventia 
Network Mail Security System Virtual Appliance provide spam 
control and preemptive protection for your messaging 
infrastructure.

Proventia Network Mail is the only email security solution equipped 
with the IBM Intrusion Prevention System (IPS) engine and a behavioral

Nearly all of LinuxRocket's features are free. Be kind and donate to the cause!