[Security-announce] UPDATED VMSA-2008-0011.1 Updated ESX service console packages for Samba and vmnix

security-announce at lists.vmware.com security-announce at lists.vmware.com
Tue Aug 12 11:22:19 PDT 2008


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2008-0011.1
Synopsis:          Updated ESX service console packages for Samba
                   and vmnix
Issue date:        2008-07-28
Updated on:        2008-08-12
CVE numbers:       CVE-2007-5001 CVE-2007-6151 CVE-2007-6206
                   CVE-2008-0007 CVE-2008-1367 CVE-2008-1375
                   CVE-2008-1669 CVE-2006-4814 CVE-2008-1105
- -------------------------------------------------------------------

1. Summary:

   Updated ESX packages address several security issues.

2. Relevant releases:

   VMware ESX 3.5 without patches ESX350-200806201-UG (vmnix) and  
   ESX350-200806218-UG (samba)
   VMware ESX 3.0.2
   VMware ESX 3.0.1

   Extended Support (Security and Bug fixes) for ESX 3.0.1 has ended on
   2008-07-31. Users should plan to upgrade to at least 3.0.2 update 1
   and preferably the newest release available.

3. Problem description:

I   Service Console rpm updates

 a.  Security Update to Service Console Kernel

   This fix upgrades service console kernel version to 2.4.21-57.EL.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)
   has assigned the names CVE-2007-5001, CVE-2007-6151, CVE-2007-6206,
   CVE-2008-0007, CVE-2008-1367, CVE-2008-1375, CVE-2006-4814, and
   CVE-2008-1669 to the security issues fixed in kernel-2.4.21-57.EL.

   VMware         Product   Running  Replace with/
   Product        Version   on       Apply Patch
   =============  ========  =======  =================
   VirtualCenter  any       Windows  not applicable

   hosted         any       any      not applicable

   ESXi           3.5       ESXi     not applicable

   ESX            3.5       ESX      patch ESX350-200806201-UG
   ESX            3.0.3     ESX      not affected
   ESX            3.0.2     ESX      affected, no update planned
   ESX            3.0.1     ESX      affected, no update planned
   ESX            2.5.5     ESX      not applicable
   ESX            2.5.4     ESX      not applicable

 b.  Samba Security Update

   This fix upgrades the service console rpm samba to version
   3.0.9-1.3E.15vmw

   The Common Vulnerabilities and Exposures project (cve.mitre.org)
   has assigned the name CVE-2008-1105 to this issue.

   VMware         Product   Running  Replace with/
   Product        Version   on       Apply Patch
   =============  ========  =======  =================
   VirtualCenter  any       Windows  not applicable

   hosted         any       any      not applicable

   ESXi           3.5       ESXi     not applicable

   ESX            3.5       ESX      patch ESX350-200806218-UG
   ESX            3.0.3     ESX      not affected
   ESX            3.0.2     ESX      affected, patch pending
   ESX            3.0.1     ESX      affected, patch pending
   ESX            2.5.5     ESX      affected, patch pending
   ESX            2.5.4     ESX      affected, patch pending

4. Solution:

Please review the patch/release notes for your product and version
and verify the md5sum of your downloaded file.

   ESX 3.5 (Samba)
   http://download3.vmware.com/software/esx/ESX350-200806218-UG
   md5sum: dfad21860ba24a6322b36041c0bc2a07
   http://kb.vmware.com/kb/1005931

   ESX 3.5 (vmnix)
   http://download3.vmware.com/software/esx/ESX350-200806201-UG
   md5sum: 2888192905a6763a069914fcd258d329
   http://kb.vmware.com/kb/1005894

   ESX 3.0.3 build 104629
   ESX Server 3.0.3 CD image
   md5sum: c2cda9242c6981c7eba1004e8fc5626d
   Upgrade package from ESX Server 2.x to ESX Server 3.0.3
   md5sum: 0ad8fa4707915139d8b2343afebeb92b
   Upgrade package from earlier releases of ESX Server 3 to ESX Server
3.0.3
   md5sum: ff7f3dc12d34b474b231212bdf314113
   release notes:
   http://www.vmware.com/support/vi3/doc/releasenotes_esx303.html

5. References:

  CVE numbers
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5001
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6151
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6206
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0007
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1367
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1375
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1669
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4814
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1105

- -------------------------------------------------------------------
6. Change log:

2008-07-28 VMSA-2008-0011    
Initial release
2008-08-12 VMSA-2008-0011.1
Added VMware ESX 3.0.3 released on 2008-08-08

- ---------------------------------------------------------------------
7. Contact:

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

  * security-announce at lists.vmware.com
  * bugtraq at securityfocus.com
  * full-disclosure at lists.grok.org.uk

E-mail:  security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2008 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8

wj8DBQFIodSdS2KysvBH1xkRAsNaAJ9sjONVO2s2NOrek+FrbRqSPoUkxQCfaKbb
Cprx0xvHmW5by+Q9nfYHNrI=
=AXZd
-----END PGP SIGNATURE-----



More information about the Security-announce mailing list