topic Re: Update VMware Tools version on HPE OnevView appliance in HPE OneView

Update VMware Tools version on HPE OnevView appliance

NJK-Work1 — Thu, 27 Jun 2024 04:13:44 GMT

Is there a way to update the VMware Tools on the HPE OneView appliance (either manually or via an HPE provided tool/script)? A recent audit shows that it is version 11269 (which maps to VMware Tools 11.0.5) and should be updated to address potential security concerns. I am running the latest available firmware version from HPE (8.90.00-0490022).

Thanks.

Query: Update VMware Tools version on HPE OnevView appliance

support_s — Thu, 27 Jun 2024 02:48:01 GMT

System recommended content:

1. HPE OneView for VMware vCenter 11.6.0 User Guide | About VMware vSphere Lifecycle Manager

2. HPE OneView for VMware vCenter 11.5.0 User Guide | About VMware vSphere Lifecycle Manager

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

Re: Update VMware Tools version on HPE OnevView appliance

ChrisLynch — Thu, 27 Jun 2024 02:49:32 GMT

No, the embedded VMware Tools is based on the open-VM tools variant and is not customer updateable. Do you have a link to what security vulnerability you believe needs to be addressed?

Re: Update VMware Tools version on HPE OnevView appliance

NJK-Work1 — Thu, 27 Jun 2024 13:40:06 GMT

Here is one link:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23642

Looks like it is fixed with version 12.1.0

It looks like the other on only affects Windows and Mac...but posting here just in case:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23678

Re: Update VMware Tools version on HPE OnevView appliance

DanCernese — Thu, 27 Jun 2024 15:45:43 GMT

https://github.com/vmware/open-vm-tools/issues/608

CVE-2022-31676

Re: Update VMware Tools version on HPE OnevView appliance

DanCernese — Thu, 27 Jun 2024 15:48:13 GMT

There are no non-priviledged users inside HPE OneView, so it is not vulnerable. Only HPE support can gain access if the customer supplies the challenge key.

"A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine."

Re: Update VMware Tools version on HPE OnevView appliance

NJK-Work1 — Tue, 02 Jul 2024 02:10:12 GMT

Cool. Thank you.

Re: Update VMware Tools version on HPE OnevView appliance

Sunitha_Mod — Tue, 02 Jul 2024 05:45:41 GMT

Hello @NJK-Work1,

Perfect!

We are glad to know your concern has been addressed.