[Security-announce] UPDATED VMSA-0008-0010.1 Updated Tomcat and Java JRE packages for VMware, ESX 3.5 and VirtualCenter 2.5

security-announce at lists.vmware.com security-announce at lists.vmware.com
Mon Jul 28 19:54:30 PDT 2008


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                    VMware Security Advisory

Advisory ID:       VMSA-2008-00010.1
Synopsis:          Updated Tomcat and Java JRE packages for VMware
                    ESX 3.5 and VirtualCenter 2.5
Issue date:        2008-06-16
Updated on:        2008-07-28 (initial release of advisory)
CVE numbers:       CVE-2007-5333 CVE-2007-5342 CVE-2007-5461
                    CVE-2007-6286 CVE-2008-1185 CVE-2008-1186
                    CVE-2008-1187 CVE-2008-1188 CVE-2008-1189
                    CVE-2008-1190 CVE-2008-1191 CVE-2008-1192
                    CVE-2008-1193 CVE-2008-1194 CVE-2008-1195
                    CVE-2008-1196 CVE-2008-0657 CVE-2007-5689
                    CVE-2007-5232 CVE-2007-5236 CVE-2007-5237
                    CVE-2007-5238 CVE-2007-5239 CVE-2007-5240
                    CVE-2007-5274
- ---------------------------------------------------------------------

1. Summary:

    Updated Tomcat and Java JRE packages for VMware ESX 3.5

2. Relevant releases:

    ESX 3.5 without patch ESX350-200806404-SG
    VirtualCenter 2.5 before Update 2 build 104263

3. Problem description:

    Updated ESX patches and VirtualCenter update 2 fix the following
    application vulnerabilities.

  a. Tomcat Server Security Update

    This release of ESX updates the Tomcat Server package to version
    5.5.26, which addresses multiple security issues that existed
    in earlier releases of Tomcat Server.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461,
    CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26.

    VMware    Product   Running  Replace with/
    Product   Version   on       Apply Patch
    ========  ========  =======  =======================
    Virtual-  2.5       Windows  Update 2 build 104263
    Center
    Virtual-  2.0.2     Windows  affected, patch pending
    Center

    hosted    any       any      not affected

    ESXi      3.5       ESXi     not affected

    ESX       3.5       ESX      ESX350-200806404-SG
    ESX       3.0.2     ESX      affected, patch pending
    ESX       3.0.1     ESX      affected, patch pending
    ESX       2.5.5     ESX      not affected
    ESX       2.5.4     ESX      not affected

  b. JRE Security Update

    This release of ESX and VirtualCenter updates the JRE package
    to version 1.5.0_15, which addresses multiple security issues
    that existed in earlier releases of JRE.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187,
    CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191,
    CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195,
    CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232,
    CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239,
    CVE-2007-5240, CVE-2007-5274 to the security issues fixed in
    JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15.

    VMware    Product   Running  Replace with/
    Product   Version   on       Apply Patch
    ========  ========  =======  =======================
    Virtual-  2.5       Windows  Update 2 build 104263
    Center
    Virtual-  2.0.2     Windows  affected, patch pending
    Center

    hosted    any       any      not affected

    ESXi      3.5       ESXi     not affected

    ESX       3.5       ESX      ESX350-200806404-SG
    ESX       3.0.2     ESX      affected, patch pending
    ESX       3.0.1     ESX      affected, patch pending
    ESX       2.5.5     ESX      not affected
    ESX       2.5.4     ESX      not affected

  Notes: These vulnerabilities can be exploited remotely only if the
         attacker has access to the service console network.
         Security best practices provided by VMware recommend that the
         service console be isolated from the VM network. Please see
         http://www.vmware.com/resources/techresources/726 for more
         information on VMware security best practices.

         The currently installed versions of Tomcat and JRE depend
         on your patch deployment history.

4. Solution:

Please review the Patch notes for your product and version and verify
the md5sum of your downloaded file.

    ESX
    ---
    VMware ESX 3.5 patch ESX350-200806404-SG (Tomcat, JRE)
    http://download3.vmware.com/software/esx/ESX350-200806404-SG.zip
    md5sum: 669e97880a21cce13eb7e9051f403162
    http://kb.vmware.com/kb/1005219

    VirtualCenter
    -------------
    VMware VirtualCenter 2.5 Update 2 build 104263
    http://www.vmware.com/download/download.do?downloadGroup=VC250U2
    DVD iso image
    md5sum: 83de404fa073bc1fde9acd080f21e688
    Zip file
    md5sum: 3297f1e47c6b018ac8190f11bd022d5b
    Release Notes
    http://www.vmware.com/support/vi3/doc/vi3_esx35u2_vc25u2_rel_notes.html

5. References:

    Tomcat release notes
    http://tomcat.apache.org/security-5.html

    Sun release notes for j2se 1.5.0_x
    http://java.sun.com/j2se/1.5.0/ReleaseNotes.html

    CVE numbers
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5333
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5342
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5461
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6286
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1185
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1186
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1187
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1188
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1189
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1190
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1191
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1192
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1193
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1194
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1195
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1196
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0657
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5689
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5236
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5237
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5239
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5240
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274

6. Change log:

2008-06-16  VMSA-2008-0010
Initial release
2008-07-28  VMSA-2008-0010.1
Added VirtualCenter 2.5 Update 2

- -----------------------------------------------------------------------
7. Contact:

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

   * security-announce at lists.vmware.com
   * bugtraq at securityfocus.com
   * full-disclosure at lists.grok.org.uk

E-mail:  security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2008 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8

wj8DBQFIjoYMS2KysvBH1xkRAuUIAJ9tBdzf6hVejXYMAMZuDCaJ2iIDVgCeJIyE
huh7Qjc9CPXKTobVk+KYx98=
=n/Oa
-----END PGP SIGNATURE-----



More information about the Security-announce mailing list