Note: There are two vCenter Server 5.5. releases issued to remediate this issue:
- If you are currently running vCenter Server 5.5 GA build 1312298, 1378903, or 1476327, upgrade to vCenter Server 5.5.0c build 1750597.
Note: vCenter Server 5.5.0c should not be updated to vCenter Server 5.5 Update 1. You can upgrade vCenter Server 5.5.0c to vCenter Server 5.5 Update 1a build 1750787.
- If you are currently running vCenter Server 5.5 Update 1 build 1623101, upgrade to vCenter Server 5.5 Update 1a build 1750787.
Note: These releases upgrade the OpenSSL libraries. The
openssl.exe
file remains unchanged and will display the same version number as it did previously.
After the vCenter Server environment is upgraded, the Single Sign-On component requires the SSL certificate for the VMware Directory Service to be re-issued and the
[email protected]
password to be changed. Any other
vsphere.local
users that have been defined will also require their passwords to be changed.
Failure to carry out these actions continues to expose the system to compromise from the OpenSSL Heartbleed vulnerability.
For more information on upgrading, see:
Symptoms:
This article provides the resolution procedure for vCenter Server 5.5 in response to the OpenSSL Heartbleed vulnerability.
Note: The Heartbleed issue affects the Windows version of vCenter Server and the VMware Client Integration Plug-in (a.k.a. the VMRC Plug-in). While the vCenter Server Appliance (vCSA) is not directly affected, it does ship with a vulnerable version of the VMware Client Integration Plug-in. Therefore, it must be upgraded so it does not distribute vulnerable plug-ins. For details on client remediation, see the
Update the Client Integration Plug-in section.
Note: If you are using vCenter Single Sign-On 5.5 or the vSphere Web Client 5.5 in a vCenter Server 5.1 environment this article also applies.
The vCenter Single Sign-On VMware Directory Service is the only Windows vCenter Server component affected by the OpenSSL Heartbleed vulnerability.
The VMware Client Integration Plug-in is a client side component that is present when users connect to the vSphere Web Client to upload OVF files, for example. Version 5.5 of this component is affected by the OpenSSL heartbleed vulnerability. This version is part of vSphere 5.5.
The patch must be applied immediately to fix the critical security vulnerability reported in CVE- 2014- 0160. Details on this vulnerability can be found in
VMware Security Advisory VMSA-2014-0004.
For details on the impact of the OpenSSL security issue, also known as Heartbleed, on VMware products and portals, see: