The vRealize Operations Manager 6.6.1, 6.7 and 7.0 Security Patch is a public Security Patch that addresses security concerns with the internal scripts of vRealize Operations Manager.
Applying the Security Patch will give ownership of the scripts to the root user from the admin user.


Refer to the VMSA-2018-0031 for information about the security issues addressed in this update.

VMware vRealize Operations Manager 7.0.x
VMware vRealize Operations Manager 6.7.x
VMware vRealize Operations Manager 6.6.x

Each of the vRealize Operations Manager 6.6.1, 6.7 and 7.0 versions have a corresponding Security Patch, and the patch can be applied to any environment of the same version.
Download and install the correct Security Patch version that matches your version of vRealize Operations Manager.
Find a complete list of the file names and their corresponding version below in the Related Information section.

It is recommended to take snapshots before applying the Security Patch.
See How to take a Snapshot of vRealize Operations Manager 6.x and later for more information. 

1. Download the vRealize Operations Manager 6.6.1, 6.7 and 7.0 Security Patch PAK file, available at VMware Downloads.

2. Log in to the primary node vRealize Operations Manager Administrator interface of your cluster at https://master-node-FQDN-or-IP-address/admin.
3. Click Software Update in the left panel.
4. Click Install a Software Update in the main panel.
5. Follow the steps in the wizard to locate and install your PAK file.
6. Install the product update PAK file.
   Wait for the software update to complete. When it does, the Administrator interface logs you out.
7. Log back into the primary node Administrator interface.
   The main Cluster Status page appears and cluster goes online automatically. The status page also displays the Bring Online button, but do not click it.
8. Clear the browser caches and if the browser page does not refresh automatically, refresh the page.
   The cluster status changes to Going Online. When the cluster status changes to Online, the upgrade is complete.
   
   Note: If a cluster fails and the status changes to offline during the installation process of a PAK file update then some nodes become unavailable. To fix this, you can access the Administrator interface and manually take the cluster offline and click Finish Installation to continue the installation process.
    
9. Click Software Update to check that the update is done.
   A message indicating that the update completed successfully appears in the main pane.

Once the update is complete delete the snapshots you made before the software update.

The following files should be applied to the corresponding version:

After the upgrade to the Security Patch, the About page will show the following build number:

Impact/Risks:
If vRealize Operations Manager is upgraded after applying Security Patch, you will need to re-apply the Security Patch if you are upgrading to a version that does not include the Security Patch.
vRealize Operations Manager 6.6.1 GA, 6.7 GA, and 7.0 GA, do not include the Security Patch.
If you upgrade to a later release, then the changes in Security Patch will already be included.