====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN111
_____________________________________________________________________

DATE                : 19/04/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running VMware vCenter Server.

=====================================================================
https://lists.vmware.com/pipermail/security-announce/2017/000375.html
____________________________________________________________________
- -----------------------------------------------------------------------

                               VMware Security Advisory

Advisory ID: VMSA-2017-0007
Severity:    Critical
Synopsis:     updates resolve a remote code
             execution vulnerability via BlazeDS
Issue date:  2017-04-13
Updated on:  2017-04-13 (Initial Advisory)
CVE number:  CVE-2017-5641

1. Summary

   VMware vCenter Server updates resolve a remote code execution
   vulnerability via BlazeDS

2. Relevant Products

   VMware vCenter Server

3. Problem Description

   Remote code execution vulnerability via BlazeDS

   VMware vCenter Server contains a remote code execution vulnerability
   due to the use of BlazeDS to process AMF3 messages. This issue may
   be exploited to execute arbitrary code when deserializing an
   untrusted Java object.

   Note:
   The issue is present in the the Customer Experience Improvement
   Program (CEIP) functionality. If a customer has opted out of CEIP
   the vulnerability is still present. Also opting out will not remove
   the vulnerability.
   The table below lists the versions of vCenter Server that have a fix
   for the issue. It also list the VMware Knowledge Base articles that
   document a workaround that removes the vulnerability.

   VMware would like to thank Markus Wulftange of Code White GmbH for
   reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
   assigned the identifier CVE-2017-5641 to this issue.

   Column 5 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is
   available.

   VMware          Product Running           Replace with/   Mitigation
   Product         Version on      Severity  Apply patch     Workaround
   ==============  ======= ======= ========  =============   ==========
   vCenter Server   6.5     Any    Critical    6.5c          KB2149815
   vCenter Server   6.0     Any    Critical    6.0U3b        KB2149816
   vCenter Server   5.5     Any      N/A      Not affected      N/A


4. Solution

   Please review the patch/release notes for your product and
   version and verify the checksum of your downloaded file.


   VMware vCenter Server 6.5c
   Downloads:
   https://www.vmware.com/support/pubs/vsphere-esxi-vcenter-
   server-6-pubs.html
   Documentation:
   https://my.vmware.com/web/vmware/details?downloadGroup=3DVC650C
   &productId=3D618&rPId=3D15826

   VMware vCenter Server 6.0U3b
   Downloads:https://my.vmware.com/web/vmware/details?downloadGroup
   =3DVC60U3B&productId=3D491&rPId=3D15722
   Documentation:
   https://www.vmware.com/support/pubs/vsphere-esxi-vcenter-
   server-6-pubs.html


5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2017-5641
   https://kb.vmware.com/kb/2149815
   https://kb.vmware.com/kb/2149816

- ------------------------------------------------------------------------

6. Change log

   2017-04-13 VMSA-2017-0007
   Initial security advisory in conjunction with the release of VMware
   vCenter Server 6.5c and 6.0U3b on 2017-04-13.

- ------------------------------------------------------------------------
7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

     security-announce@lists.vmware.com
     bugtraq@securityfocus.com
     fulldisclosure@seclists.org

   E-mail: security@vmware.com
   PGP key at: https://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Support Phases
   https://www.vmware.com/support/policies/lifecycle.html

   VMware Security & Compliance Blog
   https://blogs.vmware.com/security

   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2017 VMware Inc.  All rights reserved.


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================