====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN352
_____________________________________________________________________

DATE                : 17/11/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running VMware NSX for vSphere versions
                           6.2.x, 6.3.x prior to 6.2.9, 6.3.5.

=====================================================================
https://lists.vmware.com/pipermail/security-announce/2017/000391.html
_______________________________________________________________

- - -----------------------------------------------------------------------

                               VMware Security Advisory

Advisory ID: VMSA-2017-0019
Severity:    Moderate
Synopsis:    NSX for vSphere update addresses NSX Edge Cross-Site
             Scripting (XSS) issue.
Issue date:  2017-11-16
Updated on:  2017-11-16 (Initial Advisory)
CVE number:  CVE-2017-4929

1. Summary

   NSX for vSphere update addresses NSX Edge Cross-Site
   Scripting (XSS) issue.

2. Relevant Products

   NSX for vSphere

3. Problem Description

   a. NSX Edge Cross-Site Scripting (XSS) issue.

   NSX Edge contains a moderate Cross-Site Scripting (XSS) issue
   which may lead to information disclosure.

   VMware would like to thank Jarad Kopf of Deltek and Issam Rabhi for
   independently reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
   assigned the identifier CVE-2017-4929 to this issue.

   Column 5 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is
   available.

   VMware          Product Running           Replace with/  Mitigation
   Product         Version on      Severity  Apply patch    Workaround
   ==============  ======= ======= ========  =============  ==========
   NSX Edge        6.2.x   Any     Moderate  6.2.9             None
   NSX Edge        6.3.x   Any     Moderate  6.3.5          None


4. Solution

   Please review the patch/release notes for your product and
   version and verify the checksum of your downloaded file.

   VMware NSX for vSphere 6.2.9
   Downloads:
   https://my.vmware.com/web/vmware/details?productId=417
   &downloadGroup=NSXV_629B
   Documentation:
   https://docs.vmware.com/en/VMware-NSX-for-vSphere/index.html

   VMware NSX for vSphere 6.3.5
   Downloads: XXXXXX
   https://my.vmware.com/web/vmware/details?productId=417
   &downloadGroup=NSXV_635
   Documentation:
   https://docs.vmware.com/en/VMware-NSX-for-vSphere/index.html


5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4929

- - ------------------------------------------------------------------------

6. Change log

   2017-11-16 VMSA-2017-0019
   Initial security advisory in conjunction with the release of VMware
   NSX for vSphere 6.3.5 on 2017-11-16
- - ------------------------------------------------------------------------
7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

     security-announce at lists.vmware.com
     bugtraq at securityfocus.com
     fulldisclosure at seclists.org

   E-mail: security at vmware.com
   PGP key at: https://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Support Phases
   https://www.vmware.com/support/policies/lifecycle.html

   VMware Security & Compliance Blog
   https://blogs.vmware.com/security

   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2017 VMware Inc.  All rights reserved.

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================