The ESXi host must have all security patches and updates installed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207670	ESXI-65-000072	SV-207670r388482_rule		High

Description
Installing software updates is a fundamental mitigation against the exploitation of publicly-known vulnerabilities.

STIG	Date
VMware vSphere 6.5 ESXi Security Technical Implementation Guide	2021-09-22

Details

Check Text ( C-7925r364409_chk )
If vCenter Update Manager is used on the network it can be used to scan all hosts for missing patches. From the vSphere Client go to Hosts and Clusters > Update Manager tab and select scan to view all hosts compliance status. If vCenter Update Manager is not used a hosts compliance status must be manually determined by the build number. The following VMware KB 1014508 can be used to correlate patches with build numbers. If the ESXi host does not have the latest patches, this is a finding. If the ESXi host is not on a supported release, this is a finding. VMware also publishes Advisories on security patches, and offers a way to subscribe to email alerts for them. https://www.vmware.com/support/policies/security_response

Check Text ( C-7925r364409_chk )

If vCenter Update Manager is used on the network it can be used to scan all hosts for missing patches. From the vSphere Client go to Hosts and Clusters > Update Manager tab and select scan to view all hosts compliance status.

If vCenter Update Manager is not used a hosts compliance status must be manually determined by the build number. The following VMware KB 1014508 can be used to correlate patches with build numbers.

If the ESXi host does not have the latest patches, this is a finding.

If the ESXi host is not on a supported release, this is a finding.

VMware also publishes Advisories on security patches, and offers a way to subscribe to email alerts for them.
https://www.vmware.com/support/policies/security_response

Fix Text (F-7925r364410_fix)
If vCenter Update Manager is used on the network, hosts can be remediated from the vSphere Web Client. From the vSphere Web Client go to Hosts and Clusters >> Update Manager tab and select a non-compliant host and click the Remediate button. To manually remediate a host the patch file must be copied locally and the following command run from an SSH session connected to the ESXi host, or from the ESXi shell: esxcli software vib update -d

Fix Text (F-7925r364410_fix)

If vCenter Update Manager is used on the network, hosts can be remediated from the vSphere Web Client. From the vSphere Web Client go to Hosts and Clusters >> Update Manager tab and select a non-compliant host and click the Remediate button.

To manually remediate a host the patch file must be copied locally and the following command run from an SSH session connected to the ESXi host, or from the ESXi shell:

esxcli software vib update -d