SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   VMware vRealize Vendors:   VMware
VMware vRealize Input Validation Flaws Let Remote Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1035270
SecurityTracker URL:  http://securitytracker.com/id/1035270
CVE Reference:   CVE-2015-2344, CVE-2016-2075   (Links to External Site)
Date:  Mar 15 2016
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): vRealize Automation 6.x prior to 6.2.4; vRealize Business Advanced and Enterprise 8.x prior to 8.2.5
Description:   Two vulnerabilities were reported in VMware vRealize. A remote user can conduct cross-site scripting attacks.

The software does not properly filter HTML code from user-supplied input before displaying the input. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the target user's client workstation and will run in the security context of that system. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the system, access data recently submitted by the target user via web form to the system, or take actions on the system acting as the target user.

VMware vRealize Automation is affected [CVE-2015-2344].

Lukasz Plonka reported this vulnerability.

VMware vRealize Business Advanced and Enterprise is affected [CVE-2016-2075].

Alvaro Trigo Martin de Vidales of Deloitte Spain reported this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the target user's client workstation, access data recently submitted by the target user via web form to the system, or take actions on the system acting as the target user.
Solution:   The vendor has issued a fix (vRealize Automation 6.2.4 for Linux; vRealize Business Advanced and Enterprise 8.2.5 for Linux).

The vendor's advisory is available at:

http://www.vmware.com/security/advisories/VMSA-2016-0003.html

Vendor URL:  www.vmware.com/security/advisories/VMSA-2016-0003.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any)

Message History:   None.


 Source Message Contents

Subject:  [Security-announce] NEW VMSA-2016-0003 - VMware vRealize Automation and vRealize Business Advanced and Enterprise address Cross-Site Scripting (XSS) issues

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID: VMSA-2016-0003
Synopsis:    VMware vRealize Automation and vRealize Business Advanced 
             and Enterprise address Cross-Site Scripting (XSS) issues.
Issue date:  2016-03-15
Updated on:  2016-03-15 (Initial Advisory)
CVE number:  CVE-2015-2344, CVE-2016-2075

1. Summary

   VMware vRealize Automation and vRealize Business Advanced and 
   Enterprise address Cross-Site Scripting (XSS) issues.

2. Relevant Releases

   VMware vRealize Automation 6.x prior to 6.2.4

   VMware vRealize Business Advanced and Enterprise 8.x prior to 8.2.5

3. Problem Description

   a. Important Stored Cross-Site Scripting (XSS) issue in VMware
   vRealize Automation

   VMware vRealize Automation contains a vulnerability that may allow
   for a Stored Cross-Site Scripting (XSS) attack. Exploitation of this
   issue may lead to the compromise of a vRA user's client workstation.

   VMware would like to thank would like to thank Lukasz Plonka for 
   reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has 
   assigned the identifier CVE-2015-2344 to this issue.

   Column 4 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is 
   available.

   VMware                         Product    Running   Replace with/
   Product                        Version    on        Apply Patch
   =============                  =======    =======   =================
   VMware vRealize Automation     7.x        Linux     Not Affected
   VMware vRealize Automation     6.x        Linux     6.2.4
   VMware vRealize Automation     5.x        Windows   Not Affected

   b. Important Stored Cross-Site Scripting (XSS) issue in vRealize
   Business Advanced and Enterprise

   VMware vRealize Business Advanced and Enterprise contains a 
   vulnerability that may allow for a Stored Cross-Site Scripting (XSS)
   attack. Exploitation of this issue may lead to the compromise of a
   vRB user's client workstation.

   VMware would like to thank Alvaro Trigo Martin de Vidales of Deloitte
   Spain for reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has 
   assigned the identifier CVE-2016-2075 to this issue.

   Column 4 of the following table lists the action required to
   remediate the vulnerability in each release, if a solution is 
   available.

   VMware                         Product    Running   Replace with/
   Product                        Version    on        Apply Patch
  =============                  =======    =======   =================
   VMware vRealize Business       8.x        Linux     8.2.5
   Advanced and Enterprise
   VMware vRealize Business       7.x        Linux     Not Affected
   Standard
   VMware vRealize Business       6.x        Linux     Not Affected
   Standard

4. Solution

   Please review the patch/release notes for your product and
   version and verify the checksum of your downloaded file.

   VMware vRealize Automation 6.2.4
   Downloads and Doumentation:
  
https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage
ment/vmware_vrealize_automation/6_2

   VMware vRealize Business Advanced and Enterprise 8.2.5
   Downloads and Doumentation:
  
https://my.vmware.com/web/vmware/info/slug/infrastructure_operations_manage
ment/vmware_vrealize_business/8_2

5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2344
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2075

- - ------------------------------------------------------------------------

6. Change log

   2016-03-15 VMSA-2016-0003 Initial security advisory in conjunction 
   with the release of VMware vRealize Automation 6.2.4 and VMware
   vRealize Business Advanced and Enterprise 8.2.5 on 2016-03-15.

- - ------------------------------------------------------------------------

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

    security-announce at lists.vmware.com
    bugtraq at securityfocus.com
    fulldisclosure at seclists.org

   E-mail: security at vmware.com
   PGP key at: https://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   Consolidated list of VMware Security Advisories
   http://kb.vmware.com/kb/2078735

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Support Phases
   https://www.vmware.com/support/policies/lifecycle.html

   Twitter
   https://twitter.com/VMwareSRC

   Copyright 2016 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 15337)
Charset: utf-8

wj8DBQFW6F8WDEcm8Vbi9kMRAqCcAJ4+Wo3ThKcaVY+gUDTuUl8ER8NlOgCgpcUf
2CAHJCdDsJT5L8/oyE8dpkc=
=kgj0
-----END PGP SIGNATURE-----
_______________________________________________
Security-announce mailing list
Security-announce@lists.vmware.com
http://lists.vmware.com/mailman/listinfo/security-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC