[Security-announce] VMSA-2010-0015 VMware ESX third party updates for Service Console

VMware Security Announcements security-announce at lists.vmware.com
Thu Sep 30 01:16:12 PDT 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2010-0015
Synopsis:          VMware ESX third party updates for Service Console
Issue date:        2010-09-30
Updated on:        2010-09-30 (initial release of advisory)
CVE numbers:       CVE-2010-0826 CVE-2009-3767 CVE-2010-0734
                   CVE-2010-1646 CVE-2009-3555 CVE-2009-2409
                   CVE-2009-3245 CVE-2010-0433
- ------------------------------------------------------------------------

1. Summary

   ESX 4.0 Console OS (COS) updates for NSS_db, OpenLDAP, cURL, sudo
   OpenSSL, GnuTLS, NSS and NSPR packages.

2. Relevant releases

   VMware ESX 4.0 without patches ESX400-201009407-SG,
   ESX400-201009408-SG, ESX400-201009409-SG, ESX400-201009410-SG,
   ESX400-201009401-SG

   Notes:
   Effective May 2010, VMware's patch and update release program during
   Extended Support will be continued with the condition that all
   subsequent patch and update releases will be based on the latest
   baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
   ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
   "End of Product Availability FAQs" at
   http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
   details.

   Extended support for ESX 3.0.3 ends on 2011-12-10.  Users should plan
   to upgrade to at least ESX 3.5 and preferably to the newest release
   available.

3. Problem Description

 a. Service Console update for NSS_db

    The service console package NSS_db is updated to version
    nss_db-2.2-35.4.el5_5.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2010-0826 to this issue.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    hosted *       any       any      not affected

    ESXi           any       ESXi     not affected

    ESX            4.1       ESX      affected, patch pending
    ESX            4.0       ESX      ESX400-201009407-SG
    ESX            3.5       ESX      not applicable
    ESX            3.0.3     ESX      not applicable

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion.

 b. Service Console update for OpenLDAP

    The service console package OpenLDAP updated to version
    2.3.43-12.el5.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2009-3767 to this issue.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    hosted *       any       any      not affected

    ESXi           any       ESXi     not affected

    ESX            4.1       ESX      affected, patch pending
    ESX            4.0       ESX      ESX400-201009408-SG
    ESX            3.5       ESX      not applicable
    ESX            3.0.3     ESX      not applicable

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion.

 c. Service Console update for cURL

    The service console packages for cURL updated to version
    7.15.5-9.el5.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2010-0734 to this issue.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    hosted *       any       any      not affected

    ESXi           any       ESXi     not affected

    ESX            4.1       ESX      affected, patch pending
    ESX            4.0       ESX      ESX400-201009409-SG
    ESX            3.5       ESX      not applicable
    ESX            3.0.3     ESX      not applicable

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion.

 d. Service Console update for sudo

    The service console package sudo updated to version 1.7.2p1-7.el5_5.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2010-1646 to this issue.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    hosted *       any       any      not affected

    ESXi           any       ESXi     not affected

    ESX            4.1       ESX      affected, patch pending
    ESX            4.0       ESX      ESX400-201009410-SG
    ESX            3.5       ESX      not applicable
    ESX            3.0.3     ESX      not applicable

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion.

 e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR

    Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2
    and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8,
    and NSS to version 3.12.6-1.3235.vmw and NSPR to version
    4.8.4-1.3235.vmw. These four updates are bundled together due to
    their mutual dependencies.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245
    and CVE-2010-0433 to the issues addressed in this update.

    Column 4 of the following table lists the action required to
    remediate the vulnerability in each release, if a solution is
    available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    hosted *       any       any      not affected

    ESXi           any       ESXi     not affected

    ESX            4.1       ESX      affected, patch pending
    ESX            4.0       ESX      ESX400-201009401-SG **
    ESX            3.5       ESX      not applicable
    ESX            3.0.3     ESX      not applicable

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion.
 ** Note: This patch also addresses non-security issues. See KB article
          1023759 for details.

4. Solution

   Please review the patch/release notes for your product and version
   and verify the md5sum of your downloaded file.

   ESX 4.0
   -------
   ESX400-201009001
   Download link: http://bit.ly/adhjEu
   md5sum: 988c593b7a7abf0be5b72970ac64a369
   sha1sum: 26d875955b01c19f4e56703216e135257c08836f
   http://kb.vmware.com/kb/1025321

   ESX400-201009001 contains the following security bulletins:
      ESX400-201009407-SG (NSS_db)   | http://kb.vmware.com/kb/1023763
      ESX400-201009408-SG (OpenLDAP) | http://kb.vmware.com/kb/1023764
      ESX400-201009409-SG (cURL)     | http://kb.vmware.com/kb/1023765
      ESX400-201009410-SG (sudo)     | http://kb.vmware.com/kb/1023766
      ESX400-201009401-SG (OpenSSL, GnuTLS, NSS)
                                  | http://kb.vmware.com/kb/1023759

   And contains the following security bundles from VMSA-2010-0013.1:
      ESX400-201009402-SG (cpio)     | http://kb.vmware.com/kb/1023760
      ESX400-201009406-SG (tar)      | http://kb.vmware.com/kb/1023762
      ESX400-201009403-SG (krb5)     | http://kb.vmware.com/kb/1023761
      ESX400-201009411-SG (perl)     | http://kb.vmware.com/kb/1023767

   And also contains ESX400-201009412-BG a non-security critical update.

   To install an individual bulletin use esxupdate with the -b option.

5. References

   CVE numbers
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0826
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3767
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0734
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3245
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0433

- ------------------------------------------------------------------------

6. Change log

2010-09-30  VMSA-2010-0015
Initial security advisory after release of patches for ESX 4.0
on 2010-09-30

- -----------------------------------------------------------------------
7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

  * security-announce at lists.vmware.com
  * bugtraq at securityfocus.com
  * full-disclosure at lists.grok.org.uk

E-mail:  security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware Security Advisories
http://www.vmware.com/security/advisoiries

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2010 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)

iEYEARECAAYFAkykR0YACgkQS2KysvBH1xkjVgCePX7kG0clQ5tW43PCzWGsTQPI
vygAn2pwGSDrIPd445VybJYOS2Z40/SK
=RG4y
-----END PGP SIGNATURE-----


More information about the Security-announce mailing list