copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
Search this site

On this site

 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login


ESB-2011.0305.4 - UPDATE [Win] VMware vCenter Orchestrator(vCO) : Execute arbitrary code/commands - Remote/unauthenticated

Date: 28 October 2011
References: ESB-2014.1128  
Related Files: ESB-2011.0305   ESB-2011.0305.2  

Click here for printable version
Click here for PGP verifiable version
Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

      VMware vCenter Orchestrator remote code execution vulnerability
                              28 October 2011


        AusCERT Security Bulletin Summary

Product:           VMware vCenter Orchestrator(vCO)
Publisher:         VMware
Operating System:  Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2010-1870  

Original Bulletin:

Revision History:  October 28 2011: VMware vCenter Orchestrator 4.1 Update 2 released
                   May      9 2011: VMware vCenter Orchestrator 4.0 Update 3 released
                   April   13 2011: Initial security advisory in conjunction with the release of an Apache
                   Struts workaround for VMware vCenter Orchestrator on 2011-03-14
                   March   17 2011: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

- - ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2011-0005.3
Synopsis:          VMware vCenter Orchestrator and Alive Enterprise
                   remote code execution vulnerability
Issue date:        2011-03-14
Updated on:        2011-10-27
CVE numbers:       CVE-2010-1870
- - ------------------------------------------------------------------------

1. Summary

   A vulnerability in VMware vCenter Orchestrator (vCO) and Alive
   Enterprise could allow remote execution.

2. Relevant releases

   VMware vCenter Orchestrator 4.1 Update 1 and earlier
   VMware vCenter Orchestrator 4.0 Update 2 and earlier

   Alive Enterprise 7.2

3. Problem Description

 a. Vulnerability in third party Apache Struts component

    VMware vCenter Orchestrator is an application to automate
    management tasks. Alive Enterprise is an application to monitor
    processes. Both products embed Apache Struts which is a third
    party component.

    The following vulnerability has been reported in Apache Struts
    2.0.11 or earlier. A remote execution of code vulnerability could
    allow malicious users to bypass the '#'-usage protection built into
    the ParametersInterceptor, which could allow server side context
    objects to be manipulated.

    The Common Vulnerabilities and Exposures project (
    has assigned the name CVE-2010-1870 to this vulnerability.

    VMware would like to thank the Vulnerability Research Team of
    Digital Defense, Inc. for reporting this issue to us.

    Apache Struts version 2.0.11 and earlier also contain
    vulnerabilities which have not been assigned CVE names.  This
    advisory also addresses these vulnerabilities described at the
    following URLs:


    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    vCO            4.1       Windows  Update 2 *
    vCO            4.0       Windows  Update 3 *

    Alive          7.2       any      affected, upgrade to vCenter
    Enterprise                        Operations Enterprise 1.0 **

    vCenter        any       any      not affected

  * With vCO 4.1 Update 2 and vCO 4.0 Update 3 the workaround in
    VMware Knowledge Base article 1034175 is no longer necessary.
    vCO is part of vCenter Server.
 ** Alive Enterprise has been renamed to vCenter Operations

4. Solution

   VMware vCenter Server 4.0
   VMware vCenter Server 4.0 Update 3
   The download for vCenter Server includes VMware vCenter Orchestrator.
   Release Notes:

   File type: .iso
   md5sum: b04780df75f70621d0c8794e8773a983
   sha1sum: a9f1398306158572ea1c3d202ed8c6ad922e0764

   File type: .zip
   md5sum: bc8179a639dcc6563d7dbf968095edc7
   sha1sum: 61b6dbb1bcf3aa74503e183317a00733b0253faa

   VMware vSphere Client
   File type: .exe
   md5sum: 1b90081e422358c407ad9696c70c70f7
   sha1sum: 7ba9043421f8b529b0da08fa83458069ccac0fe9

   VMware vCenter Server 4.1
   VMware vCenter Server 4.1 Update 2
   The download for vCenter Server includes VMware vCenter Orchestrator.

   Download link:

   Release Notes:

   File: VMware-VIMSetup-all-4.1.0-493063.iso
   md5sum: d132326846a85bfc9ebbc53defeee6e1
   sha1sum: 192c3e5d2a10bbe53c025cc7eedb3133a23e0541

   md5sum: 7fd7b09e501bd8fde52649b395491222
   sha1sum: 46dd00e7c594ac672a5d7c3c27d15be2f5a5f1f1

   File: VMware-viclient-all-4.1.0-491557.exe
   md5sum: dafd31619ae66da65115ac3900697e3a
   sha1sum: 98be4d349c9a655621c068d105593be4a8e542ef

   VMware vCenter Orchestrator
   vCenter Orchestrator workaround for Apache Struts

	VMware vCenter Operations Enterprise 1.0
	Download link
	Release notes

	VMware vCenter Operations Enterprise 1.0 Windows Installer (x64 bit)

	VMware vCenter Operations Enterprise 1.0 Linux Installer (x64 bit)

5. References

   CVE numbers

- - ------------------------------------------------------------------------
6. Change log

   2011-03-14  VMSA-2011-0005
   Initial security advisory in conjunction with the release of an
   Apache   Struts workaround for VMware vCenter Orchestrator on

   2011-04-12  VMSA-2011-0005.1
   Update of security advisory after the release of vCenter Operations
   Enterprise 1.0 on 2011-04-12.

   2011-05-05  VMSA-2011-0005.2
   Update of security advisory after the release of VMware vCenter
   Orchestrator 4.0 Update 3 on 2011-05-05.

   2011-10-27  VMSA-2011-0005.3
   Update of security advisory after the release of VMware vCenter
   Orchestrator 4.1 Update 2 on 2011-10-27.

- - ------------------------------------------------------------------------

7. Contact

	E-mail list for product security notifications and announcements:
	This Security Advisory is posted to the following lists:
	  * security-announce at
	  * bugtraq at
	  * full-disclosure at
	E-mail:  security at
	PGP key at:
	VMware Security Advisories
	VMware security response policy
	General support life cycle policy
	VMware Infrastructure support life cycle policy
	Copyright 2011 VMware Inc.  All rights reserved.
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools -
Comment: Using GnuPG with Mozilla -


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email:
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.