Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2008.1014 -- [VMware ESX] Updated ESX packages for libxml2, ucd-snmp, libtiff 19 November 2008 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: VMware ESX 3.5 VMware ESX 3.0.3 VMware ESX 3.0.2 VMware ESX 2.5.5 VMware ESX 2.5.4 Publisher: VMware Operating System: VMWare ESX Server Impact: Execute Arbitrary Code/Commands Denial of Service Provide Misleading Information Access: Remote/Unauthenticated CVE Names: CVE-2008-3529 CVE-2008-3281 CVE-2008-2327 CVE-2008-0960 Ref: ESB-2008.0593 ESB-2008.0622 ESB-2008.0660 ESB-2008.0797 ESB-2008.0816 ESB-2008.0823 ESB-2008.0830 ESB-2008.0840 ESB-2008.0869 ESB-2008.0876 AL-2008.0073 AA-2008.0135 AA-2008.0201 Revision History: November 19 2008: Added reference for additional CVE November 19 2008: Updated with additional CVE entry November 3 2008: Initial Release - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2008-0017.1 Synopsis: Updated ESX packages for libxml2, ucd-snmp, libtiff Issue date: 2008-10-31 Updated on: 2008-11-17 CVE numbers: CVE-2008-3281 CVE-2008-0960 CVE-2008-2327 CVE-2008-3529 - - ------------------------------------------------------------------------ 1. Summary Updated ESX packages for libxml2, ucd-snmp, libtiff. 2. Relevant releases ESX 3.0.3 without patch ESX303-200810503-SG ESX 3.0.2 without patch ESX-1006968 ESX 2.5.5 before Upgrade Patch 10 ESX 2.5.4 before Upgrade Patch 21 NOTE: Extended support (Security and Bug fixes) for ESX 3.0.2 ended on 2008-10-29. Extended support (Security and Bug fixes) for ESX 2.5.4 ended on 2008-10-08. Extended support for ESX 3.0.2 Update 1 ends on 2009-08-08. Users should plan to upgrade to ESX 3.0.3 and preferably to the newest release available. 3. Problem Description a. Updated ESX Service Console package libxml2 A denial of service flaw was found in the way libxml2 processes certain content. If an application that is linked against libxml2 processes malformed XML content, the XML content might cause the application to stop responding. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-3281 to this issue. Additionally the following was also fixed, but was missing in the security advisory. A heap-based buffer overflow flaw was found in the way libxml2 handled long XML entity names. If an application linked against libxml2 processed untrusted malformed XML content, it could cause the application to crash or, possibly, execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-3529 to this issue. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= VirtualCenter any Windows not affected hosted any any not affected ESXi 3.5 ESXi not affected ESX 3.5 ESX affected, patch pending ESX 3.0.3 ESX ESX303-200810503-SG ESX 3.0.2 ESX ESX-1006968 ESX 2.5.5 ESX ESX 2.5.5 upgrade patch 10 or later ESX 2.5.4 ESX ESX 2.5.4 upgrade patch 21 * hosted products are VMware Workstation, Player, ACE, Server, Fusion. b. Updated ESX Service Console package ucd-snmp A flaw was found in the way ucd-snmp checks an SNMPv3 packet's Keyed-Hash Message Authentication Code. An attacker could use this flaw to spoof an authenticated SNMPv3 packet. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-0960 to this issue. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= VirtualCenter any Windows not affected hosted any any not affected ESXi 3.5 ESXi not affected ESX 3.5 ESX not affected ESX 3.0.3 ESX not affected ESX 3.0.2 ESX not affected ESX 2.5.5 ESX ESX 2.5.5 upgrade patch 10 or later ESX 2.5.4 ESX ESX 2.5.4 upgrade patch 21 * hosted products are VMware Workstation, Player, ACE, Server, Fusion. c. Updated third party library libtiff Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-2327 to this issue. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= VirtualCenter any Windows not affected hosted any any not affected ESXi 3.5 ESXi not affected ESX 3.5 ESX not affected ESX 3.0.3 ESX not affected ESX 3.0.2 ESX not affected ESX 2.5.5 ESX ESX 2.5.5 upgrade patch 10 or later ESX 2.5.4 ESX ESX 2.5.4 upgrade patch 21 * hosted products are VMware Workstation, Player, ACE, Server, Fusion. 4. Solution Please review the patch/release notes for your product and version and verify the md5sum of your downloaded file. ESX --- ESX 3.0.3 patch ESX303-200810503-SG http://download3.vmware.com/software/vi/ESX303-200810503-SG.zip md5sum: e687313e58377be41f6e6b767dfbf268 http://kb.vmware.com/kb/1006971 ESX 3.0.2 patch ESX-1006968 http://download3.vmware.com/software/vi/ESX-1006968.tgz md5sum: fc9e30cff6f03a209e6a275254fa6719 http://kb.vmware.com/kb/1006968 VMware ESX 2.5.5 Upgrade Patch 10 http://download3.vmware.com/software/esx/esx-2.5.5-119702-upgrade.tar.gz md5sum: 2ee87cdd70b1ba84751e24c0bd8b4621 http://vmware.com/support/esx25/doc/esx-255-200810-patch.html VMware ESX 2.5.4 Upgrade Patch 21 http://download3.vmware.com/software/esx/esx-2.5.4-119703-upgrade.tar.gz md5sum: d791be525c604c852a03dd7df0eabf35 http://vmware.com/support/esx25/doc/esx-254-200810-patch.html 5. References CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3281 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3529 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0960 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2327 - - ------------------------------------------------------------------------ 6. Change log 2008-10-31 VMSA-2008-0017 Initial security advisory after release of ESX 3.0.3, ESX 3.0.2, ESX 2.5.5 and ESX 2.5.4 patches on 2008-10-30. 2008-11-17 VMSA-2008-0017.1 Added missing CVE number for libxml2. - - ----------------------------------------------------------------------- 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Center http://www.vmware.com/security VMware security response policy http://www.vmware.com/support/policies/security_response.html General support life cycle policy http://www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html Copyright 2008 VMware Inc. All rights reserved. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEUEAREIAAYFAkkeEaQACgkQS2KysvBH1xnyYwCdHiJpNOIJOd4rKcF9VROdvRY4 A1UAl0IzVe9tgTlNJ+pdrSBz64uOKXo= =Df9W - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBSSNNRyh9+71yA2DNAQI7ZQP/bRSpr9PvjLpQvs6I6CI+jMZelmwjaeCr Qy0MhckrAeEUd8vtA24LmvczH3vnk3jQRR6sK4Crrmpk/FoeACReXphyl8RzngH+ VuiO9hExcr5kfd013LQijLIHj5yBj8vgz8qlIVeBVtOc+YZ8oPjK1QSZMY/eF7H/ M+1pzIuYuP8= =uF+e -----END PGP SIGNATURE-----