VMware Security Advisory – VMSA-2010-0015

it is the time of the week for the security advisories again,  one interesting thing of note is that for the first time ESX 2.x.x is not even considered, and also VMware Server has been dropped from the list of Hosted platforms.

Also note the warning about ESX 3.0.3 as its EOL is nigh.

Synopsis: VMware ESX third party updates for Service Console
Issue date: 2010-09-30
Updated on: 2010-09-30 (initial release of advisory)
CVE numbers: CVE-2010-0826 CVE-2009-3767 CVE-2010-0734 CVE-2010-1646 CVE-2009-3555 CVE-2009-2409 CVE-2009-3245 CVE-2010-0433

 1. Summary

ESX 4.0 Console OS (COS) updates for NSS_db, OpenLDAP, cURL, sudo OpenSSL, GnuTLS, NSS and NSPR packages.

2. Relevant releases

VMware ESX 4.0 without patches ESX400-201009407-SG, ESX400-201009408-SG, ESX400-201009409-SG, ESX400-201009410-SG, ESX400-201009401-SG

Notes: Effective May 2010, VMware’s patch and update release program during Extended Support will be continued with the condition that all subsequent patch and update releases will be based on the latest baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1, ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section "End of Product Availability FAQs" at http://www.vmware.com/support/policies/lifecycle/vi/faq.html for details.

Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan to upgrade to at least ESX 3.5 and preferably to the newest release available.

3. Problem Description

a. Service Console update for NSS_db The service console package NSS_db is updated to version nss_db-2.2-35.4.el5_5.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0826 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product Product Version Running on Replace with/Apply Patch
VirtualCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009407-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

b. Service Console update for OpenLDAP The service console package OpenLDAP updated to version 2.3.43-12.el5.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-3767 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product Product Version Running on Replace with/Apply Patch
VirtualCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009408-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

c. Service Console update for cURL The service console packages for cURL updated to version 7.15.5-9.el5.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product Product Version Running on Replace with/Apply Patch
VirtualCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009409-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

d. Service Console update for sudo. The service console package sudo updated to version 1.7.2p1-7.el5_5.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-1646 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product Product Version Running on Replace with/Apply Patch
VirtualCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009410-SG
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2 and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8, and NSS to version 3.12.6-1.3235.vmw and NSPR to version

4.8.4-1.3235.vmw. These four updates are bundled together due to their mutual dependencies.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245 and CVE-2010-0433 to the issues addressed in this update.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product Product Version Running on Replace with/Apply Patch
VirtualCenter any Windows not affected
hosted * any any not affected
ESXi any ESXi not affected
ESX 4.1 ESX affected, patch pending
ESX 4.0 ESX ESX400-201009401-SG **
ESX 3.5 ESX not applicable
ESX 3.0.3 ESX not applicable

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

** Note: This patch also addresses non-security issues. See KB article 1023759 for details.

4. Solution

Please review the patch/release notes for your product and version and verify the md5sum of your downloaded file.

ESX 4.0

ESX400-201009001
Download link: http://bit.ly/adhjEu
md5sum: 988c593b7a7abf0be5b72970ac64a369
sha1sum: 26d875955b01c19f4e56703216e135257c08836f
http://kb.vmware.com/kb/1025321

ESX400-201009001 contains the following security bulletins:
ESX400-201009407-SG (NSS_db) | http://kb.vmware.com/kb/1023763
ESX400-201009408-SG (OpenLDAP) | http://kb.vmware.com/kb/1023764
ESX400-201009409-SG (cURL) | http://kb.vmware.com/kb/1023765
ESX400-201009410-SG (sudo) | http://kb.vmware.com/kb/1023766
ESX400-201009401-SG (OpenSSL, GnuTLS, NSS)
| http://kb.vmware.com/kb/1023759

And contains the following security bundles from VMSA-2010-0013.1:
ESX400-201009402-SG (cpio) | http://kb.vmware.com/kb/1023760
ESX400-201009406-SG (tar) | http://kb.vmware.com/kb/1023762
ESX400-201009403-SG (krb5) | http://kb.vmware.com/kb/1023761
ESX400-201009411-SG (perl) | http://kb.vmware.com/kb/1023767

And also contains ESX400-201009412-BG a non-security critical update.

To install an individual bulletin use esxupdate with the -b option.

5. References

CVE numbers

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0826
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0734
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0433

6. Change log

2010-09-30 VMSA-2010-0015
Initial security advisory after release of patches for ESX 4.0 on 2010-09-30

7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

  • security-announce at lists.vmware.com
  • bugtraq at securityfocus.com
  • full-disclosure at lists.grok.org.uk

E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware Security Advisories
http://www.vmware.com/security/advisoiries

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2010 VMware Inc. All rights reserved.

1 ping

  1. […] This post was mentioned on Twitter by VMware Planet V12n, Chris House. Chris House said: The benefits of ESXi – "not affected": VMware ESX 4.x Security Advisory VMSA-2010-0015 (via @PlanetV12n) http://planetvm.net/blog/?p=1724 […]

Comments have been disabled.

%d bloggers like this: