Chris Colotti's Blog Thoughts and Theories About…
It’s no secret that in recent months, Broadcom has been dragging their feet getting CVSS 9+ patches in the hands of people that no longer have active support. In fact I covered this along with some other means of mitigations previously. However, I recently stumbled across some changes I noticed on the Broadcom download site that “appears” to be moving in the right direction. Keep reading for the quick and easy way to get to some of these critical patches, along with the other free downloads like VMware Fusion. Bear in mind I am referring to downloads whereby you may not even have entitlement anymore to the original product, but Broadcom has committed to providing CVSS 9+ critical updates to everyone. Albeit, there is also some potential delay that’s been talked about upwards of 90 days as you will see in a minute.
Downloading Free VMware Patches
The first thing you will need from my testing is ANY usable login to the Broadcom Download site. I even created a brand new login with no Site ID, or product entitlement to really see if I can access the free downloads. Once you log in, click the “My Downloads” option on the left and you will notice something very interesting, but also not very obvious.
That new link, if you miss it, it the key you need to start finding the downloads you may be trying to access.
Once you “click HERE,” you will be taken to this page, where I have highlighted a few things of interest.
If you run VMware Fusion and have tried to update from the app, you now get a message that you can’t and this is where you come to manually download it. There is this KB article talking about it as well. More importantly is the vSphere, vCenter, and VMware Tools sections because the most recent CVE’s that include critical updates for these items can now be found here!
Now, for example if you click into VMware vSphere the first thing you see is two tabs, Products and Solutions. While you may or may not see something in the product section, that is less important that looking under the Solutions tab. Also note the phrase in the blue box which as written, does seem to address the previous issue of customers without support and these being supplied “as-is”. Frankly that makes sense when you read it.
You will now see Version 7 and Version 8 along with the critical updates from March, but NOT those yet from July that were indicated as CVSS 9+.
Finally, when you choose a Release Version, you will see the depot downloads which do in fact download fine. However, as I mentioned I am not seeing the July updates yet as there could be some 90-Day delay of some sort in play, but I cannot confirm that.
At this point once you download the depot bundle, you should be able to use various means to install it via esxcli or update manager. Hopefully this helps some customers that have been trying to access these CVSS 9+ critical patches find them.
