To anticipate the questions you will surely get from your local Security Officer, I created a function to report which vSphere Servers in your environment are impacted, and which action to take.

Update October 5th 2015:

• Updated build numbers in $vmsaTab
• Corrected build number testing (thanks Richard)

The Script

function Get-VMSA-2015-0007
{
<#
.SYNOPSIS  Report on VMSA-2015-0007 vulnerabilities
.DESCRIPTION The function will look at all connected
  vSphere servers ($global:defaultviservers), and 
  report which ones are impacted by VMSA-2015-0007,
  and which action to take
.NOTES  Author:  Luc Dekens
.EXAMPLE
  PS> Get-VMSA-2015-0007
#>
  
  Begin
  {
  
    $vmsaTab = @(
      @{
        Vulnerability = 'CVE-2015-5177'
        Product = 'Vmware ESXi'
        Safe = @(
          @{
            Version = '5.5'
            Build = '3029837'
            Action = 'ESXi550-201509101'
          },
          @{
            Version = '5.1'
            Build = '3021178'
            Action = 'ESXi510-201510101'
          },
          @{
            Version = '5.0'
            Build = '3021432'
            Action = 'ESXi500-201510101'
          }
        )
      },
      @{
        Vulnerability = 'CVE-2015-2342'
        Product = 'VMware vCenter Server'
        Safe = @(
          @{
            Version = '6.0'
            Build = '3018521'
            Action = '6.0 u1'
          },
          @{
            Version = '5.5'
            Build = '3000241'
            Action = '5.5 u3'
          },
          @{
            Version = '5.1'
            Build = '3072311'
            Action = '5.1 u3b'
          },
          @{
            Version = '5.0'
            Build = '3073234'
            Action = '5.0 u3e'
          }
        )
      },
      @{
        Vulnerability = 'CVE-2015-1047'
        Product = 'VMware vCenter Server'
        Safe = @(
          @{
            Version = '5.5'
            Build = '2063318'
            Action = '5.5u2'
          },
          @{
            Version = '5.1'
            Build = '2308385'
            Action = '5.1u3'
          },
          @{
            Version = '5.0'
            Build = '3073234'
            Action = '5.0u3e'
          }
        )
      }
    )
  }
  
  Process
  {
    foreach($vc in $global:DefaultVIServers){
      Foreach($dc in (Get-Datacenter -Server $vc)){
        Foreach($esx in Get-VMHost -Location $dc -Server $vc){
          $product = $esx.ExtensionData.Config.Product
          foreach($entry in ($vmsaTab | where{$_.Product -eq $product.Name})){
            $esx | Select @{N='vCenter';E={$vc.Name}},
              @{N='Datacenter';E={$dc.Name}},
              @{N='Cluster';E={$_.Parent}},
              @{N='Name';E={$_.Name.Split('.')[0]}},
              @{N='Product';E={$product.Name}},
              Version,
              Build,
              @{N='CVE';E={$entry.Vulnerability}},
              @{N='Safe';E={
                $script:entrySafe = $entry.Safe | where{$esx.Version -match "^$($_.Version)"}
                if($script:entrySafe -ne $null){
                  if([int]$esx.Build -ge [int]$script:entrySafe.Build){[string]$true}else{[string]$false} 
                }
                else{'na'}
              }},
              @{N='Action';E={
                if($script:entrySafe -ne $null){
                  $script:entrySafe.Action
                }
                else{'na'}
              }}
          }
        }
      }
      $product = $vc.ExtensionData.Content.About
      foreach($entry in ($vmsaTab | where{$_.Product -eq $product.Name})){
        $vc | Select @{N='vCenter';E={$vc.Name}},
          @{N='Datacenter';E={''}},
          @{N='Cluster';E={''}},
          @{N='Name';E={$_.Name.Split('.')[0]}},
          @{N='Product';E={$product.Name}},
          Version,
          Build,
          @{N='CVE';E={$entry.Vulnerability}},
          @{N='Safe';E={
            $script:entrySafe = $entry.Safe | where{$vc.Version -match "^$($_.Version)"}
            if($script:entrySafe -ne $null){
              if([int]$vc.Build -ge [int]$entrySafe.Build){[string]$true}else{[string]$false}
            }
            else{'na'}
          }},
          @{N='Action';E={
            if($script:entrySafe -ne $null){
            $script:entrySafe.Action
            }
            else{'na'}
          }}
      }
    }
  }
}

Annotations

Line 17-85: The correlation between each of the vulnerabilities, the vSphere Server version and build and the fix mentioned in VMSA-2015-0007. Note that KB1014508, where one can normally find all update levels and the corresponding build number, is missing some of the proposed solutions from VMSA-2015-0007. For these I tried to determine the desired build number from the Product Download page under MyVMware. Also note that the Product Patches page under MyVMware, doesn’t seem to use the same terminology that is used in VMSA-2015-0007.

Line 91: the script uses the connected vCenters, as available in $Global:DefaultVIServers, to scan. It’s important that you connect to the vCenter(s) before you call the function.

Sample Usage

The function will look at all connected vCenters. It uses the values in $Global:DefaultVIServers to find these connected vSphere vCenters. For each vCenter it will query all connected ESXi servers.

Get-VMSA-2015-0007 |
Export-Csv -Path C:\VMSA-2015-0007.csv -NoTypeInformation -UseCulture

The function returns an object array with all results from the investigation. When you redirect the result to a CSV file, you will get something like this.

Note that CVE-2015-1047 and CVE-2015-2342 list different fix levels for the vCenter. The report lists the build corresponding with the CVE (Common Vulnerabilities and Exposures). You should of course apply the highest build, that way you will comply with both requirements.

Should you find any discrepancies in the product, versions and build numbers, please let me know.

Enjoy!