[Security-announce] NEW VMSA-2013-0009 VMware ESX and ESXi updates to third party libraries

VMware Security Announcements security-announce at lists.vmware.com
Wed Jul 31 21:00:41 PDT 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID: VMSA-2013-0009
Synopsis:    VMware ESX and ESXi updates to third party libraries
Issue date:  2013-07-31
Updated on:  2013-07-31 (initial advisory)
CVE number:  
 --OpenSSL ---
CVE-2013-0169, CVE-2013-0166
 --libxml2 (COS and userworld) ---
CVE-2013-0338
 --GnuTLS (COS) ---
CVE-2013-2116
- --Kernel (COS) ---
CVE-2013-0268, CVE-2013-0871

- -----------------------------------------------------------------------

1. Summary

   VMware has updated several third party libraries in ESX and ESXi to
   address multiple security vulnerabilities.

2. Relevant releases

   VMware ESXi 4.1 without patch ESXi410-201307001

   VMware ESX 4.1 without patch ESX410-201307001

3. Problem Description 

   a. ESX userworld update for OpenSSL library

      The userworld OpenSSL library is updated to version openssl-0.9.8y
      to resolve multiple security issues.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the names CVE-2013-0169 and CVE-2013-0166 to these
      issues.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        ESXi            5.1       ESXi     patch pending
        ESXi            5.0       ESXi     patch pending
        ESXi            4.1       ESXi     ESXi410-201307401-SG
        ESXi            4.0       ESXi     patch pending

        ESX             4.1       ESX      ESX410-201307403-SG
        ESX             4.0       ESX      patch pending

   b. Service Console (COS) update for OpenSSL library

      The Service Console updates for OpenSSL library is updated to version
      openssl-0.9.8e-26.el5_9.1 to resolve multiple security issues.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the names CVE-2013-0169 and CVE-2013-0166 to these
      issues.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        ESXi            any       any      not applicable 

        ESX             4.1       ESX      ESX410-201307403-SG
        ESX             4.0       ESX      patch pending
 
   c. ESX Userworld and Service Console (COS) update for libxml2 library 

      The ESX Userworld and Service Console libxml2 library is updated to
      version libxml2-2.6.26-2.1.21.el5_9.1 and 
      libxml2-python-2.6.26-2.1.21.el5_9.1. to resolve a security issue.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the name CVE-2013-0338 to this issue.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        ESXi            5.1       ESXi     patch pending
        ESXi            5.0       ESXi     patch pending
        ESXi            4.1       ESXi     ESXi410-201307401-SG
        ESXi            4.0       ESXi     patch pending
     
        ESX             4.1       ESX      ESX410-201307405-SG
        ESX             4.0       ESX      patch pending
    
   d. Service Console (COS) update for GnuTLS library 

      The ESX service console GnuTLS RPM is updated to version
      gnutls-1.4.1-10.el5_9.1 to resolve a security issue.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the name CVE-2013-2116 to this issue.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        ESXi            any       ESXi     not applicable

        ESX             4.1       ESX      ESX410-201307404-SG
        ESX             4.0       ESX      patch pending

   e. ESX third party update for Service Console kernel 

      The ESX Service Console Operating System (COS) kernel is updated 
      to kernel-2.6.18-348.3.1.el5 which addresses several security
      issues in the COS kernel. 

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the names CVE-2013-0268 and CVE-2013-0871 to these
      issues. 

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        ESXi	        any	  ESXi	   not affected

        ESX             4.1       ESX      ESX410-201307401-SG
        ESX             4.0       ESX      patch pending
  
 4. Solution

  Please review the patch/release notes for your product and version 
  and verify the checksum of your downloaded file. 

   ESXi and ESX
   ------------
   http://downloads.vmware.com/go/selfsupport-download

   ESXi 4.1
   --------
   File: ESXi410-201307001.zip
   md5sum: b171ea162cd753782483fa64196e8152
   sha1sum: f2f19db06864a05eb4fdfea57626576f2836e718
   http://kb.vmware.com/kb/2053396


   ESX 4.1
   -------
   File: ESX410-201307001.ZIP
   md5sum: 60f15f96454b953f7747486a6a261e4f
   sha1sum: 8e494b450f539ed65729205333dc3598d6ba87f8
   http://kb.vmware.com/kb/2053393
   
5. References

   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0166
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0338
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2116
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0871
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0268

- -----------------------------------------------------------------------

6. Change log

   2013-07-31 VMSA-2013-0009
   Initial security advisory in conjunction with the release of 
   ESX 4.1 patches on 2013-07-31.

- -----------------------------------------------------------------------

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
   
   This Security Advisory is posted to the following lists:
   
     * security-announce at lists.vmware.com
     * bugtraq at securityfocus.com
     * full-disclosure at lists.grok.org.uk
   
   E-mail:  security at vmware.com
   PGP key at: http://kb.vmware.com/kb/1055
   
   VMware Security Advisories
   http://www.vmware.com/security/advisories
   
   VMware security response policy
   http://www.vmware.com/support/policies/security_response.html
   
   General support life cycle policy
   http://www.vmware.com/support/policies/eos.html
   
   VMware Infrastructure support life cycle policy
   http://www.vmware.com/support/policies/eos_vi.html
   
   Copyright 2013 VMware Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.0 (Build 8741)
Charset: utf-8

wj8DBQFR+dMfDEcm8Vbi9kMRAs70AKD69AolQql36+j6nAEh7Et32FzXdgCfZB/6
Pm7BBTcIr6CFU3Okun4sZU0=
=8GBp
-----END PGP SIGNATURE-----



More information about the Security-announce mailing list