Update VMware Tools version on HPE OnevView appliance

[NJK-Work1]

Is there a way to update the VMware Tools on the HPE OneView appliance (either manually or via an HPE provided tool/script)?  A recent audit shows that it is version 11269 (which maps to VMware Tools 11.0.5) and should be updated to address potential security concerns.  I am running the latest available firmware version from HPE (8.90.00-0490022).

Thanks.

[support_s]

System recommended content:

1. HPE OneView for VMware vCenter 11.6.0 User Guide | About VMware vSphere Lifecycle Manager

2. HPE OneView for VMware vCenter 11.5.0 User Guide | About VMware vSphere Lifecycle Manager

Please click on "Thumbs Up/Kudo" icon to give a "Kudo".

Thank you for being a HPE valuable community member.

[ChrisLynch]

No, the embedded VMware Tools is based on the open-VM tools variant and is not customer updateable. Do you have a link to what security vulnerability you believe needs to be addressed?

[NJK-Work1]

Here is one link:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23642

Looks like it is fixed with version 12.1.0

It looks like the other on only affects Windows and Mac...but posting here just in case:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23678

[DanCernese]

https://github.com/vmware/open-vm-tools/issues/608

CVE-2022-31676

[DanCernese · Accepted solution]

There are no non-priviledged users inside HPE OneView, so it is not vulnerable.  Only HPE support can gain access if the customer supplies the challenge key.

"A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine."

[NJK-Work1]

Cool.  Thank you.

[Sunitha_Mod]

Hello @NJK-Work1,

Perfect! 

We are glad to know your concern has been addressed.