====================================================================

                              CERT-Renater

                    Note d'Information No. 2016/VULN116
_____________________________________________________________________

DATE                : 16/03/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running VMware vRealize Automation
                        versions 6.x prior to 6.2.4,
                       VMware vRealize Business Advanced and Enterprise
                        versions 8.x prior to 8.2.5.

======================================================================
http://lists.vmware.com/pipermail/security-announce/2016/000322.html
_____________________________________________________________________

- - ------------------------------------------------------------------------
                    VMware Security Advisory

Advisory ID: VMSA-2016-0003
Synopsis:    VMware vRealize Automation and vRealize Business Advanced
              and Enterprise address Cross-Site Scripting (XSS) issues.
Issue date:  2016-03-15
Updated on:  2016-03-15 (Initial Advisory)
CVE number:  CVE-2015-2344, CVE-2016-2075

1. Summary

    VMware vRealize Automation and vRealize Business Advanced and
    Enterprise address Cross-Site Scripting (XSS) issues.

2. Relevant Releases

    VMware vRealize Automation 6.x prior to 6.2.4

    VMware vRealize Business Advanced and Enterprise 8.x prior to 8.2.5

3. Problem Description

    a. Important Stored Cross-Site Scripting (XSS) issue in VMware
    vRealize Automation

    VMware vRealize Automation contains a vulnerability that may allow
    for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this
    issue may lead to the compromise of a vRA user's client workstation.

    VMware would like to thank would like to thank Lukasz Plonka for
    reporting this issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the identifier CVE-2015-2344 to this issue.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

    VMware                         Product    Running   Replace with/
    Product                        Version    on        Apply Patch
    =============                  =======    =======   =================
    VMware vRealize Automation     7.x        Linux     Not Affected
    VMware vRealize Automation     6.x        Linux     6.2.4
    VMware vRealize Automation     5.x        Windows   Not Affected

    b. Important Stored Cross-Site Scripting (XSS) issue in vRealize
    Business Advanced and Enterprise

    VMware vRealize Business Advanced and Enterprise contains a
    vulnerability that may allow for a Stored Cross-Site Scripting (XSS)
    attack. Exploitation of this issue may lead to the compromise of a
    vRB user's client workstation.

    VMware would like to thank Alvaro Trigo Martin de Vidales of Deloitte
    Spain for reporting this issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the identifier CVE-2016-2075 to this issue.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

    VMware                         Product    Running   Replace with/
    Product                        Version    on        Apply Patch
   =============                  =======    =======   =================
    VMware vRealize Business       8.x        Linux     8.2.5
    Advanced and Enterprise
    VMware vRealize Business       7.x        Linux     Not Affected
    Standard
    VMware vRealize Business       6.x        Linux     Not Affected
    Standard

4. Solution

    Please review the patch/release notes for your product and
    version and verify the checksum of your downloaded file.

    VMware vRealize Automation 6.2.4
    Downloads and Doumentation:

https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage
ment/vmware_vrealize_automation/6_2

    VMware vRealize Business Advanced and Enterprise 8.2.5
    Downloads and Doumentation:

https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage
ment/vmware_vrealize_business/8_2

5. References

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2344
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2075

- - ------------------------------------------------------------------------

6. Change log

    2016-03-15 VMSA-2016-0003 Initial security advisory in conjunction
    with the release of VMware vRealize Automation 6.2.4 and VMware
    vRealize Business Advanced and Enterprise 8.2.5 on 2016-03-15.

- - ------------------------------------------------------------------------

7. Contact

    E-mail list for product security notifications and announcements:
    http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

    This Security Advisory is posted to the following lists:

     security-announce at lists.vmware.com
     bugtraq at securityfocus.com
     fulldisclosure at seclists.org

    E-mail: security at vmware.com
    PGP key at: https://kb.vmware.com/kb/1055

    VMware Security Advisories
    http://www.vmware.com/security/advisories

    Consolidated list of VMware Security Advisories
    http://kb.vmware.com/kb/2078735

    VMware Security Response Policy
    https://www.vmware.com/support/policies/security_response.html

    VMware Lifecycle Support Phases
    https://www.vmware.com/support/policies/lifecycle.html

    Twitter
    https://twitter.com/VMwareSRC

    Copyright 2016 VMware Inc.  All rights reserved.

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================