VMware has updated vSphere third party libraries.
Apply the missing patch(es).
a. DDoS vulnerability in NTP third party libraries The NTP daemon has a DDoS vulnerability in the handling of the "monlist" command. An attacker may send a forged request to a vulnerable NTP server resulting in an amplified response to the intended target of the DDoS attack. b. Update to ESXi glibc package The ESXi glibc package is updated to version glibc-2.5-118.el5_10.2 to resolve a security issue. c. vCenter and Update Manager, Oracle JRE 1.7 Update 45 Oracle JRE is updated to version JRE 1.7 Update 45, which addresses multiple security issues that existed in earlier releases of Oracle JRE.
vCenter Server Appliance 5.5 prior to 5.5 Update 1 VMware vCenter Server 5.5 prior 5.5 Update 1 VMware Update Manager 5.5 prior 5.5 Update 1 VMware ESXi 5.5 without patch ESXi550-201403101-SG
Checks for missing patches.
Updated on 2015-03-25
- VMSA-2012-0018: VMware security updates for vCSA and ESXi
- VMSA-2013-0016 VMware ESXi and ESX unauthorized file access through vCenter Server and ESX
- VMSA-2014-0005: VMware Workstation, Player, Fusion, and ESXi patches address a guest privilege escalation
- VMSA-2014-0004 VMware product updates address OpenSSL security vulnerabilities
- VMSA-2013-0009 VMware ESX and ESXi updates to third party libraries