[Security-announce] Updated VMSA-2008-0004.1 Low: Updated e2fsprogs service console package

security-announce at lists.vmware.com security-announce at lists.vmware.com
Fri Apr 11 18:42:24 PDT 2008


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------
~                   VMware Security Advisory

Advisory ID:       VMSA-2008-0004.1
Synopsis:          Low: Updated e2fsprogs service console package
Issue date:        2008-03-03
Updated on:        2008-04-11
CVE numbers:       CVE-2007-5497
- -------------------------------------------------------------------

1. Summary:

~   Updated service console package e2fsprogs.

2. Relevant releases:

~   VMware ESX 3.5 without patch ESX350-200803214-UG

~   VMware ESX 3.0.2 without patch ESX-1003523
~   VMware ESX 3.0.1 without patch ESX-1003517

~   ESX Server 2.5.5 Upgrade Patch 5
~   ESX Server 2.5.4 Upgrade Patch 16

NOTE: ESX 3.0.1 is in Extended Support and its end of support (Security
and Bug fixes) is 07/31/2008.  Users should plan to upgrade to at least
3.0.2 update 1 and preferably the newest release available before the
end of extended support.

NOTE: ESX 2.5.4 is in Extended Support and its end of support (Security
and Bug fixes) is 10/08/2008.  Users should plan to upgrade to at least
2.5.5 and preferably the newest release available before the end of
extended support.

ESX Server versions 3.0.0 and prior to 2.5.4 are no longer in Extended
Support.  Users should upgrade to a supported version of the product.

The VMware Infrastructure Support Life Cycle Policy can be
found here:  http://www.vmware.com/support/policies/eos_vi.html

3. Problem description:

~   Updated e2fsprogs package address multiple integer overflow flaws

~   Thanks to Rafal Wojtczuk of McAfee Avert Research for identifying and
~   reporting this issue.

~   The Common Vulnerabilities and Exposures project (cve.mitre.org) has
~   assigned the name CVE-2007-5497 to this issue.

4. Solution:

Please review the Patch notes for your product and version and verify
the md5sum of your downloaded file.

ESX 3.5 Patch ESX350-200803214-UG
http://download3.vmware.com/software/esx/ESX350-200803214-UG.zip
md5sum: 9ff7b416afed3acfbfbb5d1d63ca5060
http://kb.vmware.com/kb/1003721

VMware ESX 3.0.2 patch ESX-1003523
http://download3.vmware.com/software/vi/ESX-1003523.tgz
md5sum: 13cf97c1b44449658ad1057b2c1bfbab
http://kb.vmware.com/kb/1003523

VMware ESX 3.0.1 patch ESX-1003517
http://download3.vmware.com/software/vi/ESX-1003517.tgz
md5sum: a3229df6e7711c8b89ef2d82aa825cab
http://kb.vmware.com/kb/1003517

ESX Server 2.5.5 Upgrade Patch 5
http://download3.vmware.com/software/esx/esx-2.5.5-73417-upgrade.tar.gz
md5sum: cf0addac42cb2057c47065971f56bee6
http://www.vmware.com/support/esx25/doc/esx-255-200802-patch.html

ESX Server 2.5.4 Upgrade Patch 16
http://download3.vmware.com/software/esx/esx-2.5.4-73416-upgrade.tar.gz
md5sum: b7b2cbfd45380124c128831dca8bc2b0
http://www.vmware.com/support/esx25/doc/esx-254-200802-patch.html

5. References:

~   CVE numbers
~   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5497

6. Change log:

2008-03-28  VMSA-2008-0004    Initial release
2008-04-11  VMSA-2008-0004.1  Added patch information for
~                              ESX 3.0.1, ESX 3.0.2, ESX 3.5
~                              for patch release on 2008-04-10

- -------------------------------------------------------------------
7. Contact:

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

~  * security-announce at lists.vmware.com
~  * bugtraq at securityfocus.com
~  * full-disclosure at lists.grok.org.uk

E-mail:  security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

Security web site
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2008 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFIABNtS2KysvBH1xkRCIyiAJ97hfT9fXToWFzGtfRrDX3FA6PoXgCff5n2
gf6jN91I/iMWboipoWeDcX8=
=wyEk
-----END PGP SIGNATURE-----



More information about the Security-announce mailing list