Loading

×Sorry to interrupt
CSS Error

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Upgrading the Jetty Web server embedded in VMware vCenter Update Manager by using a security fix (1023962)

Last Updated: 9/7/2015Categories: Total Views: 24177Language:
English

1 like this article

Subscribe to get an email
newsletter with new updates

1 people found this helpful Please provide article feedback:

Details

The following VMware vCenter Update Manager versions embed the Jetty Web server version 6.1.6:

Update Manager 1.0 Update 2 and later

Update Manager 4.0

Update Manager 4.0 Update 1

Update Manager 4.0 Update 1 Patch 1

Update Manager 4.0 Update 1 Patch 2

Update Manager 4.0 Update 2

Update Manager 4.1

Two security vulnerabilities are reported for Jetty 6.1.6:

CVE-2009-1523 identifies a directory traversal vulnerability, which allows for obtaining files from the system where Update Manager is installed by a remote, unauthenticated attacker. The attacker would need to be on the same network as the system where Update Manager is installed.

CVE-2009-1524 identifies a cross-site scripting vulnerability, which allows for running JavaScript in the browser of the user who clicks a URL containing a malicious request to Update Manager. For an attack to be successful the attacker would need to lure the user into clicking the malicious URL.

The vulnerabilities are classified as important, according to the VMware Security Response Policy.

The vulnerabilities are fixed in Jetty version 6.1.17 and later. This article explains how to apply a security fix and remove the vulnerabilities in existing Update Manager installations by upgrading to Jetty 6.1.22. The solution applies to all supported Update Manager versions.

Solution

Apply the security fix
To upgrade the embedded Jetty Web server, do the following:

Log in as an administrator to the machine on which the Update Manager server is installed.

Download VUM-KB-1023962.exe to a local directory.

Download VUM-KB-1023962.exe from Customer Connect to a local directory.

(Optional) Verify that the MD5 or SHA1 checksum of the downloaded file matches one of the following:

MD5SUM: 1140cb4f897f8f63d780068f480dac4e

SHA1SUM: d5f67eba67bda001bfc2b52c9b1a53d6757b7199

For more information on verifying the checksum match, see Using Cryptographic Hashes.

To run the security fix, double-click VUM-KB-1023962.exe.

On the welcome page of the wizard, click Next.

To accept the EULA and start the upgrade, click I Agree.

(Optional) To view the log messages, click Show details.

When the upgrade completes, click Close.

Verify that Jetty is upgraded to version 6.1.22.

In a command prompt, navigate to the Update_Manager_installation_folder\jetty-6.1.6\ directory.

The default path to the installation folder in 32-bit Windows is C:\ProgramFiles\VMware\Infrastructure\Update Manager

The default path to the installation folder in 64-bit Windows is C:\Program Files(x86)\VMware\Infrastructure\Update Manager

Run the command for checking the current Jetty version.

To view the current Jetty version in Update Manager 4.1 and Update Manager 4.0 and the subsequent update releases, run the following command:
..\jre\bin\java -jar start.jar --version

To view the current Jetty version in Update Manager 1.0 Update 6, run the following command:
..\jre-1.5.0-16\bin\java -jar start.jar --version

Reapplying the security fix after upgrading Update Manager
If you apply the security fix and then upgrade to a newer version of Update Manager that also contains the security flaws, you might need to reapply the fix.

Note: Before reapplying the fix, verify that your upgraded Update Manager installation contains the security flaws. All affected versions are listed at the top of this page.

Reapply the security fix after you perform these upgrades:

Upgrade from Update Manager 1.0 Update 6 to any version up to Update Manager 4.0 Update 2.

Upgrade from Update Manager 4.0 to any version up to Update Manager 4.0 Update 2.

Upgrade from Update Manager 4.0, 4.0 Update 1, 4.0 Update 1 Patch 1, 4.0 Update 1 Patch 2, or 4.0 Update 2 to Update Manager 4.1.

To reapply the fix:

After upgrading Update Manager to any of the preceding versions, check the Jetty version.

In a command prompt, navigate to the <Update_Manager_installation_folder>\jetty-6.1.6\ directory.

The default path to the installation folder in 32-bit Windows is C:\ProgramFiles\VMware\Infrastructure\Update Manager

The default path to the installation folder in 64-bit Windows is C:\Program Files(x86)\VMware\Infrastructure\Update Manager

Run the command for checking the current Jetty version.

To view the current Jetty version in Update Manager 4.1, Update Manager 4.0 and the subsequent update releases, run this command:
..\jre\bin\java -jar start.jar --version

To view the current Jetty version in Update Manager 1.0 Update 6, run the following command:
..\jre-1.5.0-16\bin\java -jar start.jar --version

If the Jetty version is 6.1.6, reapply the fix by using the procedure in the Apply the security fix section.

Reapplying the security fix might result in an error message if an old Jetty registry key is present on the machine

If your Jetty version is 6.1.6 and you reapply the security fix after an upgrade of Update Manager, an error message might appear. The error message reads "VMware vCenter Update Manager <version_number> does not require this patch." In such a scenario, remove the JettyVersion registry key before reapplying the fix.

Click Start > Run, type regedit.exe, and click OK.

Navigate to Jetty registry key location.

The path in 32-bit Windows is HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Update Manager.

The path in 64-bit Windows is HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Update Manager.

Delete the JettyVersion registry entry.

Reapply the security fix.

Copyright statements and licenses
The attached open_source_license_VUM-KB-1023962.txt contains the copyright statements and license(s) that apply to various open source software components (or portions thereof) that will be made available to VMware vCenter Update Manager upon installation. Use of such open source software is pursuant to such open source license terms and your end user license agreement for VMware vCenter Update Manager.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

1023962_open_source_license_VUM.txt

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
FAQ：vCenter Server 5.5 から vCenter Server Appliance 6.0 U2m への移行 (2146439)

KB
•
Download and Install VMware Fusion (2014097)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

Take Our Survey

Support Assistant