Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Manually upgrade the Jetty Web server embedded in VMware vCenter Update Manager (1023594)

Last Updated: 3/24/2017Categories: Total Views: 5022Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

The following VMware vCenter Update Manager versions embed the Jetty Web server version 6.1.6:

Update Manager 1.0 Update 2 and later

Update Manager 4.0

Update Manager 4.0 Update 1

Update Manager 4.0 Update 2

Update Manager 4.1

Two Jetty security vulnerabilities have been discovered:

CVE-2009-1523 (http://jira.codehaus.org/browse/JETTY-1004)

CVE-2009-1524 (http://jira.codehaus.org/browse/JETTY-980)

The vulnerability identified by CVE-2009-1523 is a directory traversal vulnerability. It allows for obtaining files from the system where Update Manager is installed by a remote, unauthenticated attacker. The attacker would need to be on the same network as the system where Update Manager is installed.

The vulnerability identified by CVE-2009-1524 is a cross-site scripting vulnerability. It allows for running JavaScript in the browser of the user who clicks a URL containing a malicious request to Update Manager. For an attack to be successful the attacker would need to lure the user into clicking the malicious URL.

The vulnerabilities are classified as Important, according to the VMware Security Response Policy.

These vulnerabilities are fixed in Jetty version 6.1.17 and onwards. This KB article explains how to fix the vulnerabilities in existing Update Manager installations by manually upgrading to Jetty 6.1.22.
574906

Solution

To upgrade the Jetty version embedded in Update Manager:

Log in as an administrator to the machine on which the Update Manager server is installed.

Download Jetty from the following link:
http://dist.codehaus.org/jetty/jetty-6.1.22/jetty-6.1.22.zip

Extract the contents of the jetty-6.1.22.zip into a temporary directory.
For example, if your temporary directory is C:\Temp, after you extract the content of the .zip file in this directory, and run the dir command in a command prompt, you see the following:

Volume in drive C is <name_of_the_machine>
Volume Serial Number is XXXX-XXXX
Directory of C:\Temp
MM/DD/YYYY hh:mm AM <dir> .
MM/DD/YYYY hh:mm AM <dir> ..
MM/DD/YYYY hh:mm AM <dir> jetty-6.1.22
0 File(s); 0 bytes
In this example, <name_of_the_machine> is the name of the computer where you extracted the .zip file, and the MM/DD/YYYY time is determined by when you extracted the files from the .zip file.

Stop the Update Manager service:

Right-click My Computer and select Manage.

In the left pane of the Computer Management window, expand Services and Applications and click Services.

In the right pane, right-click VMware vCenter Update Manager and select Stop.

In Windows Explorer, navigate to the Update Manager installation folder.

The default path to the installation folder in 32-bit Windows is C:\Program Files\VMware\Infrastructure\Update Manager

The default path to the installation folder in 64-bit Windows is C:\Program Files (x86)\VMware\Infrastructure\Update Manager

Back up the <Update_Manager_installation_folder>\jetty-6.1.6\ directory and the <Update_Manager_installation_folder>\jetty-vum.xml file.

Copy <Update_Manager_installation_folder>\jetty-6.1.6\webapps\vum-fileupload.war to the C:\Temp\jetty-6.1.22\webapps\ directory.
Note: This step is not applicable to Update Manager 1.0.x.

Copy <Update_Manager_installation_folder>\jetty-6.1.6\etc\jetty.xml to the C:\Temp\jetty-6.1.22\etc\ directory and overwrite the file.

Navigate to C:\Temp\jetty-6.1.22\ and copy all of the files in that directory to the <Update_Manager_installation_folder>\jetty-6.1.6\ directory.

Download the attached jetty-vum.zip file.
You can see the jetty-vum.zip file under the Attachments section of this KB article.

Extract the jetty-vum.xml file into the <Update_Manager_installation_folder> directory.

Start the Update Manager service.

Right-click My Computer and select Manage.

In the left pane of the Computer Management window, expand Services and Applications and click Services.

In the right pane, right-click VMware vCenter Update Manager and select Start.

Verify that Jetty is upgraded to version 6.1.22.

In a command prompt, navigate to the <Update_Manager_installation_folder>\jetty-6.1.6\ directory.

The default path to the installation folder in 32-bit Windows is C:\Program Files\VMware\Infrastructure\Update Manager

The default path to the installation folder in 64-bit Windows is C:\Program Files (x86)\VMware\Infrastructure\Update Manager

Run the following command:
"<path_to_java_executable>\java.exe" -jar start.jar --version

For example, the full default path to Java 6 in 64-bit Windows is C:\Program Files (x86)\Java\jre6\bin\java.exe. You must specify the full path to java.exe in the command only if the Java executable is not set in your PATH system variable.

</dir></dir></dir>

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

jetty-vum.zip

Additional Resources

KB
•
vCenter Converter 导入计算机进行到 1% 时失败 (1034292)

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vCenter Update Manager

Related Versions:

VMware vCenter Update Manager 4.1.x

VMware vCenter Update Manager 4.0.x

VMware vCenter Update Manager 1.0.x

Take Our Survey

Support Assistant