Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0498.3
VMware product updates resolve mishandled file descriptor
vulnerability in runc container runtime.
25 February 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: VMware Integrated OpenStack with Kubernetes
VMware vSphere Integrated Containers
VMware PKS
VMware vCloud Director Container Service Extension
Publisher: VMware
Operating System: Virtualisation
Impact/Access: Root Compromise -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-5736
Reference: ESB-2019.0488
ESB-2019.0466
ESB-2019.0458
ESB-2019.0428
ESB-2019.0427
Original Bulletin:
https://www.vmware.com/security/advisories/VMSA-2019-0001.html
Revision History: February 25 2019: Updated security advisory in conjunction
with the release of VMware PKS 1.3.3 and
1.2.10 on 2019-02-22. Note: VMware PKS 1.3.2
and 1.2.9 were incorrectly listed as resolving
CVE-2019-5736 in the original version of
this advisory.
February 20 2019: Added VMSA-2019-0001.1 and VMSA-2019-0001.2
February 18 2019: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
VMware Security Advisories
VMSA-2019-0001.3
VMware product updates resolve mishandled file descriptor vulnerability in runc
container runtime.
VMware Security Advisory
Advisory ID: VMSA-2019-0001.3
Severity: Important
Synopsis: VMware product updates resolve mishandled file descriptor
vulnerability in runc container runtime.
Issue date: 2019-02-15
Updated on: 2019-02-22
CVE numbers: CVE-2019-5736
1. Summary
VMware product updates resolve mishandled file descriptor vulnerability in runc
container runtime.
2. Relevant Products
- -VMware Integrated OpenStack with Kubernetes (VIO-K)
- -VMware PKS (PKS)
- -VMware vCloud Director Container Service Extension (CSE)
- -vSphere Integrated Containers (VIC)
3. Problem Description
VMware product updates resolve mishandled file descriptor vulnerability in runc
container runtime. Successful exploitation of this issue may allow a malicious
container to overwrite the contents of a host's runc binary and execute
arbitrary code. Exploitation of this vulnerability requires the attacker to
have existing permission to deploy containers or run docker exec.
Alternatively, an attacker could trick a user with these permissions into
deploying a malicious container or running docker exec for them.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the identifier CVE-2019-5736 to this issue.
Column 5 of the following table lists the action required to remediate the
vulnerability in each release, if a solution is available.
+-----------+-----------+-------+---------+------------------+----------------+
| VMware | Product |Running|Severity | Replace_with/ | Mitigation/ |
| Product | Version | On | | Apply_Patch | Workaround |
+-----------+-----------+-------+---------+------------------+----------------+
|VIO-K |5.x |Any |Important|Patch Pending |None |
+-----------+-----------+-------+---------+------------------+----------------+
|PKS |1.3.x |Any |Important|1.3.3 |None |
+-----------+-----------+-------+---------+------------------+----------------+
|PKS |1.2.x |Any |Important|1.2.10 |None |
+-----------+-----------+-------+---------+------------------+----------------+
|CSE |1.x |Any |Important|1.2.7 |None |
+-----------+-----------+-------+---------+------------------+----------------+
|VIC |1.x |Any |Important|1.5.1 |None |
+-----------+-----------+-------+---------+------------------+----------------+
4. Solution
Please review the patch/release notes for your product and version and verify
the checksum of your downloaded file.
VMware PKS 1.3.3
Downloads:
https://network.pivotal.io/products/pivotal-container-service/#/releases/309133
Documentation:
https://docs.vmware.com/en/VMware-Pivotal-Container-Service/1.3/rn/
VMware-PKS-13-Release-Notes.html
VMware PKS 1.2.10
Downloads:
https://network.pivotal.io/products/pivotal-container-service/#/releases/309126
Documentation:
https://docs.vmware.com/en/VMware-Pivotal-Container-Service/1.2/rn/
VMware-PKS-12-Release-Notes.html
VMware vCloud Director Container Service Extension 1.2.7
Downloads:
https://pypi.org/project/container-service-extension/1.2.7/
Documentation:
https://vmware.github.io/container-service-extension/RELEASE_NOTES.html
vSphere Inegrated Containers 1.5.1
Downloads:
https://my.vmware.com/web/vmware/info/slug/datacenter_cloud_infrastructure/
vmware_vsphere_integrated_containers/1_5
Documentation:
https://docs.vmware.com/en/VMware-vSphere-Integrated-Containers/1.5.1/rn/
VMware-vSphere-Integrated-Containers-151-Release-Notes.html
5. References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5736
https://pivotal.io/security/cve-2019-5736
6. Change log
2019-02-15: VMSA-2019-0001
Initial security advisory following the release of VMware PKS 1.3.2 and 1.2.9
on 2019-02-13.
2019-02-15: VMSA-2019-0001.1
Updated security advisory in conjunction with the release of VMware vCloud
Director Container Service Extension 1.2.7 on 2019-02-15.
2019-02-19: VMSA-2019-0001.2
Updated security advisory in conjunction with the release of vSphere Integrated
Containers 1.5.1 on 2019-02-19.
2019-02-22: VMSA-2019-0001.3
Updated security advisory in conjunction with the release of VMware PKS 1.3.3
and 1.2.10 on 2019-02-22. Note: VMware PKS 1.3.2 and 1.2.9 were incorrectly
listed as resolving CVE-2019-5736 in the original version of this advisory.
7. Contact
E-mail list for product security notifications and announcements:
https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXHOco2aOgq3Tt24GAQhmnxAAlee87KqOB8PzXkO2v8pmzePV0ISWn56W
FaHGdMjAqgohrA+4egwvZsnlpoGklOEo7B0LAtmfKkDS0/xH5T+GmtkD9UrA9pl/
Lq3fyYcIJllNg6oZN9PZVQFsMKkJy/kUKrjIayh6IYOCU4Q3JcplD1grCgfeWNsA
TfGrILOA0rI3n9XQfFvUS0lJ3/njPoKT8zsoPe9BPlM6SvKmFXHGXLCurqwCddQZ
dBD1JLOotP/8iST/j8dIVoKgTZ4l/6f/EcQeneeEsJ87pLBxJ5CVXrNP1pHzyXJu
h8UZvTF6Vt2PZZuW75QhlHmEkVAZn+ey9DUQthxS4Eu6ULWkDNExnM9jIMZpSdh9
jtsCmC4326EEPGG07evP0jOe45TNmy87O3stx4DrIiEaocVqyQe1BXaf/8B3iRzE
fBk76DrLgQIHqmrhVwnys5hTk/BHxxK2Vzsgyqfz+/qekTWfKONvmbQYNwyiVZ4+
NhkTlEM9X4uRmT8bxCN6sCk9wAClL20yVdbIoF3Y2u5O/0jQCSmc+8dXAE1namOB
xh2bLDUK987J7dGm42LLwpdJeBg0WeZH+aYRydGbiSD9gDGHaF8ozot1JRMn0rnQ
rhEqIJI7AAW61mBkWEqEg8cPcn6N3npYzMfXRCiycKpvK8TjeQ9G4Tw42BDxjhXf
vT0UmGhYTyI=
=jqH9
-----END PGP SIGNATURE-----