Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Updating VMware Validated Design for Software-Defined Data Center 5.x for VMSA-2020-0006 (CVE-2020-3952) (78751)

Last Updated: 4/23/2020Categories: How toTotal Views: 3310Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Purpose

Per VMSA-2020-0006, version 6.7 of vCenter Server and Platform Service Controllers (embedded or external) prior to 6.7 Update 3f are affected by CVE-2020-3952 only if it was upgraded from a previous release line, such as 6.0 or 6.5. New deployments for VMware Validated Design for Software-Defined Data Center 5.x are not affected.

This article outlines the procedures to update the Software-Defined Data Center (SDDC) that is deployed according to the VMware Validated Design for Software-Defined Data Center 5.x to address VMSA-2020-0006. This article is only applicable to VMware Validated Design for Software-Defined Data Center 5.x  deployments that have been upgraded from VMware Validated Design for Software-Defined Data Center 4.x.

Updates in Scope for this Article:

Update each Platform Service Controller appliance to 6.7 Update 3f.

Update each Management vCenter Server Appliance instance and each Compute vCenter Server Appliance instance to 6.7 Update 3f.

Updates out of Scope for this Article:

Update of vSphere Update Manager Download Service to 6.7 Update 3

Update of ESXi hosts to 6.7 Update 3

Update of vSphere Replication, Site Recovery Manager, and vRealize Suite Lifecycle Manager

Important:

Specific components in the VMware Validated Design for Software-Defined Data Center 5.0 and 5.0.1 are not compatible with 6.7 Update 3f per the VMware Product Interoperability Matrices. These include vRealize Suite Lifecycle Manager, vSphere Replication, and Site Recovery Manager.

For multi-region deployments, to ensure the ability to replicate and perform failover VMware recommends upgrading to VMware Validated Design for Software-Defined Data Center 5.1 before updating to 6.7 Update 3f. If you can not perform the upgrade to VMware Validated Design for Software Defined Data Center 5.1 before applying the 6.7 Update 3f you can individually update (Reference 1 and 2) these components and realign to the 5.1.x BOM during your next upgrade cycle.

Impact / Risks

Prerequisites

Before you remediate VMSA-2020-0006 (CVE-2020-3952) in the SDDC, verify that your existing VMware Validated Design environment meets certain general prerequisites.

Verify that your environment implementation was upgraded from VMware Validated Design 4.3.

Use VMware Knowledge Base article 78543 to determine whether or not your environment is affected by CVE-2020-3952.

Verify that your environment implementation follows exactly the software bill of materials for VMware Validated Design 5.0, 5.0.1, 5.1, or 5.1.1 releases.

Download the vCenter Server Appliance 6.7 Update 3f patch VMware-vCenter-Server-Appliance-6.7.0.43000-15976714-patch-FP.iso file from My VMware to a Windows host that has access to the SDDC management network.

Verify that you have current backups for each Platform Services Controller appliance and each vCenter Server Appliance.

Verify that any integrations with the Management and Compute vCenter Server Appliances are quiesced. For example, vRealize Automation or vSphere API for Data Protection enabled backup solutions.

Resolution

Procedure

Update the Platform Services Controller Appliances and the Management vCenter Server Appliance Instances

Take snapshots of the Platform Services Controller appliances and of the Management vCenter Server Appliance instances in Region A and in Region B.

Setting

Value

Name

VMware Validated Design 5.x for VMSA-2020-0006.1 Virtual Infrastructure Layer Update

Description

-

Snapshot the virtual machine’s memory

Deselected

Quiesce guest file system (Needs VMware Tools installed)

Deselected

Use the vSphere Web Client to log in to the Management vCenter Server Appliance by navigating to http://RegionA-management-vc-FQDN/vsphere-client/.

Navigate to the Management Platform Services Controller appliance.

Right-click the Management Platform Services Controller and select Snapshots > Take Snapshot.

In the Take VM Snapshot dialog box, enter the settings provided in the above table and click OK.

Repeat steps a-d for all Platform Services Controller appliances and the Management vCenter Server in Region A and in Region B.

Redirect the traffic to the Compute Platform Services Controller in Region A.

Use the vSphere Web Client to log in to the Management vCenter Server Appliance by navigating to http://RegionA-management-vc-FQDN/vsphere-client/.

From the Home menu, select Networking & Security > NSX Edges.

From the NSX Manager drop-down menu, select the management-nsx-manager-IP NSX Manager, and double-click the Region-A-PSC-LB NSX Edge device.

On the Manage tab, click Load Balancer > Pools.

Select the psc-https-443 load balancer pool and click Edit.

In the Edit Pool dialog box, from the Members pane, select RegionA-Management-PSC, and click Edit.

In the Edit Member dialog box, from the State drop-down menu, select Disable, and click OK.

In the Edit Pool dialog box, click OK.

Repeat steps e-h for the psc-tcp-389 load balancer pool.

On the Pools page, click Show Pools Statistics and verify that both psc-https-443 and psctcp-389 show status DOWN for RegionA-Management-PSC.

Update the Management Platform Services Controller in Region A.

Mount the update VMware-vCenter-Server-Appliance-6.7.0.43000-15976714-patch-FP.iso file to the Management Platform Services Controller appliance.

Log in to the appliance management interface of the Management Platform Service Controller by navigating to https://RegionA-management-psc-FQDN:5480.

In the left pane, click Update.

In the Update pane, click Check Updates and select Check CDROM.

Click Stage & Install.

In the End User License Agreement section, accept the EULA and click Next.

In the Backup Platform Services Controller section, check the I have backed up Platform Services Controller and its associated databases checkbox and click Finish.

After the update completes, in the Installing Upgrades dialog box click OK.

Log back in to the Management Platform Service Controller and in the left pane, click Update.

In the Update pane, verify that you see the updated version number.

Restore load balancing for the traffic to the Platform Services Controller appliances in Region A.

Use the vSphere Web Client to log in to the Management vCenter Server Appliance by navigating to http://RegionA-management-vc-FQDN/vsphere-client/.

From the Home menu, select Networking & Security > NSX Edges.

From the NSX Manager drop-down menu, select the management-nsx-manager-IP NSX Manager, and double-click the Region-A-PSC-LB NSX Edge device.

On the Manage tab, click Load Balancer > Pools.

Select the psc-https-443 load balancer pool and click Edit.

In the Edit Pool dialog box, from the Members pane, select RegionA-Management-PSC, and click Edit.

In the Edit Member dialog box, from the State drop-down menu, select Enable, and click OK.

In the Edit Pool dialog box, click OK.

Repeat steps e-h for the psc-tcp-389 load balancer pool.

On the Pools page, click Show Pools Statistics and verify that both psc-https-443 and psctcp-389 report status UP for RegionA-Management-PSC.

Disconnect the attached update .iso file from the Management Platform Services Controller in Region A.

Repeat steps 2-5 on the Compute Platform Services Controller in Region A.

Update the Management vCenter Server in Region A.

Mount the update VMware-vCenter-Server-Appliance-6.7.0.43000-15976714-patch-FP.iso file to the Management vCenter Server appliances from the vSphere Web Client.

Log in to the appliance management interface of the Management Platform Service Controller by navigating to https://RegionA-management-vc-FQDN:5480.

In the left pane, click Update.

In the Update pane, click Check Updates and select Check CDROM.

Click Stage & Install.

In the End User License Agreement section, accept the EULA and click Next.

In the Backup Platform Services Controller section, check the I have backed up Platform Services Controller and its associated databases checkbox and click Finish.

After the update completes, in the Installing Upgrades dialog box click OK.

Log back in to the appliance management interface of the Management vCenter Server and in the left pane, click Update.

In the Update pane, verify the version number.

Disconnect the attached update .iso file from the Management vCenter Server in Region A.

Repeat steps 2-8 for the Platform Services Controller appliances and for the Management vCenter Server Appliance Instances in Region B.

Update the Compute vCenter Server Appliances

Update the Compute vCenter Server Appliance in Region A.

Mount the update VMware-vCenter-Server-Appliance-6.7.0.43000-15976714-patch-FP.iso file to the Compute vCenter Server Appliance.

Log in to the appliance management interface of the Compute vCenter Server Appliance by navigating to https://RegionB-compute-vc-FQDN:5480.

In the left pane, click Update.

In the Update pane, click Check Updates and select Check CDROM.

Click Stage & Install.

In the End User License Agreement section, accept the EULA and click Next.

In the Backup Platform Services Controller section, check the I have backed up Platform Services Controller and its associated databases checkbox and click Finish.

After the update finishes, in the Installing Upgrades dialog box click OK.

Log back in to the appliance management interface of the Compute vCenter Server Appliance and click Update in the left pane.

Verify the version number in the Update pane.

Disconnect the attached update .iso file from the Compute vCenter Server in Region A.

Repeat steps 1-2 for the Compute vCenter Server in Region B.

Cleanup Snapshots and Execute Backup

After all update operations are successfully completed, verify the operations of your environment. You may use the VMware Validated Design Operational Verification guide to assist in your validation procedures.

Once verified, you may remove all pre-upgrade snapshots for each vCenter Server and Platform Services Controller instance.

Delete the snapshots for the Platform Services Controller appliances and Management vCenter Server instances in Region A and in Region B.

Use the vSphere Web Client to log in to the Management vCenter Server Appliance by navigating to http://RegionA-management-vc-FQDN/vsphere-client/.

Navigate to the Management Platform Services Controller.

Right-click the Management Platform Services Controller and select Snapshots > Delete All Snapshots.

In the Confirm Delete dialog box, click Yes.

Repeat steps a-d for all Platform Services Controller appliances and the Management vCenter Servers in Region A and in Region B.

Delete the snapshots for the Compute vCenter Server instances in Region A and in Region B.

Use the vSphere Web Client to log in to the Management vCenter Server Appliance by navigating to http://RegionA-management-vc-FQDN/vsphere-client/.

Navigate to the Compute vCenter Server.

Right-click the Compute vCenter Server and select Snapshots > Delete All Snapshots.

In the Confirm Delete dialog box, click Yes.

Repeat steps a-d for the Compute vCenter Server instances in Region B.

Initiate a new image-based backup for each vCenter Server and Platform Services Controller using a your supported vSphere APIs for Data Protection (VADP) enabled backup solution.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
Workspace ONE UEM コンソールで Content Gateway を構成する方法 (50115334)

KB
•
Mac OS X を実行する仮想マシンのディスクを拡張した後でゲスト ディスク ユーティリティを使用してパーティションを拡張できない (2069255)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Validated Design

Related Versions:

VMware Validated Design for Software-Defined Data Center (SDDC) 5.1.x

VMware Validated Design for Software-Defined Data Center (SDDC) 5.0.x

VMware Validated Design for Software-Defined Data Center (SDDC)

Take Our Survey

Support Assistant