BugTraq
VMSA-2010-0015 VMware ESX third party updates for Service Console Sep 30 2010 08:31AM
VMware Security team (security vmware com)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------

VMware Security Advisory

Advisory ID: VMSA-2010-0015
Synopsis: VMware ESX third party updates for Service Console
Issue date: 2010-09-30
Updated on: 2010-09-30 (initial release of advisory)
CVE numbers: CVE-2010-0826 CVE-2009-3767 CVE-2010-0734
CVE-2010-1646 CVE-2009-3555 CVE-2009-2409
CVE-2009-3245 CVE-2010-0433
- ------------------------------------------------------------------------

1. Summary

ESX 4.0 Console OS (COS) updates for NSS_db, OpenLDAP, cURL, sudo
OpenSSL, GnuTLS, NSS and NSPR packages.

2. Relevant releases

VMware ESX 4.0 without patches ESX400-201009407-SG,
ESX400-201009408-SG, ESX400-201009409-SG, ESX400-201009410-SG,
ESX400-201009401-SG

Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.

Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.

3. Problem Description

a. Service Console update for NSS_db

The service console package NSS_db is updated to version
nss_db-2.2-35.4.el5_5.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-0826 to this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected

hosted * any any not affected

ESXi any ESXi not affected

ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009407-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

b. Service Console update for OpenLDAP

The service console package OpenLDAP updated to version
2.3.43-12.el5.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3767 to this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected

hosted * any any not affected

ESXi any ESXi not affected

ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009408-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

c. Service Console update for cURL

The service console packages for cURL updated to version
7.15.5-9.el5.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-0734 to this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected

hosted * any any not affected

ESXi any ESXi not affected

ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009409-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

d. Service Console update for sudo

The service console package sudo updated to version 1.7.2p1-7.el5_5.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1646 to this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected

hosted * any any not affected

ESXi any ESXi not affected

ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009410-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR

Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2
and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8,
and NSS to version 3.12.6-1.3235.vmw and NSPR to version
4.8.4-1.3235.vmw. These four updates are bundled together due to
their mutual dependencies.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245
and CVE-2010-0433 to the issues addressed in this update.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected

hosted * any any not affected

ESXi any ESXi not affected

ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009401-SG **
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.
** Note: This patch also addresses non-security issues. See KB article
1023759 for details.

4. Solution

Please review the patch/release notes for your product and version
and verify the md5sum of your downloaded file.

ESX 4.0
-------
ESX400-201009001
Download link: http://bit.ly/adhjEu
md5sum: 988c593b7a7abf0be5b72970ac64a369
sha1sum: 26d875955b01c19f4e56703216e135257c08836f
http://kb.vmware.com/kb/1025321

ESX400-201009001 contains the following security bulletins:
ESX400-201009407-SG (NSS_db) | http://kb.vmware.com/kb/1023763
ESX400-201009408-SG (OpenLDAP) | http://kb.vmware.com/kb/1023764
ESX400-201009409-SG (cURL) | http://kb.vmware.com/kb/1023765
ESX400-201009410-SG (sudo) | http://kb.vmware.com/kb/1023766
ESX400-201009401-SG (OpenSSL, GnuTLS, NSS)
| http://kb.vmware.com/kb/1023759

And contains the following security bundles from VMSA-2010-0013.1:
ESX400-201009402-SG (cpio) | http://kb.vmware.com/kb/1023760
ESX400-201009406-SG (tar) | http://kb.vmware.com/kb/1023762
ESX400-201009403-SG (krb5) | http://kb.vmware.com/kb/1023761
ESX400-201009411-SG (perl) | http://kb.vmware.com/kb/1023767

And also contains ESX400-201009412-BG a non-security critical update.

To install an individual bulletin use esxupdate with the -b option.

5. References

CVE numbers
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0826
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0734
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0433

- ------------------------------------------------------------------------

6. Change log

2010-09-30 VMSA-2010-0015
Initial security advisory after release of patches for ESX 4.0
on 2010-09-30

- -----------------------------------------------------------------------
7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk

E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware Security Advisories
http://www.vmware.com/security/advisoiries

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2010 VMware Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)

iEYEARECAAYFAkykSsUACgkQS2KysvBH1xn89gCcCMcHvt1LDG9pNh5lbRmxphDg
R2UAmQHIUDg4mWUStJolvh98eiTS140I
=bM3K
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus