SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   VMware Vendors:   VMware, Inc.
VMware Guest Virtual Device Driver Bug Lets Local Users Deny Service
SecurityTracker Alert ID:  1021973
SecurityTracker URL:  http://securitytracker.com/id/1021973
CVE Reference:   CVE-2008-4916   (Links to External Site)
Date:  Apr 6 2009
Impact:   Denial of service via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in VMware. A local user on a guest operating system can cause denial of service conditions.

A local user on a guest operating system can exploit an unspecified flaw in a guest virtual device driver to cause the host operating system to crash.

VMware Workstation, Player, ACE, Server, Fusion, ESXi, and ESX are affected.

Andrew Honig of the U.S. Department of Defense reported this vulnerability.

Impact:   A local user on the guest operating system can cause the host operating system to crash.
Solution:   The vendor has issued the following fixes.

Workstation 6.5.x any 6.5.1 build 126130 or later
Workstation 6.0.x any upgrade to at least 6.5.1
Workstation 5.5.x any 5.5.9 build 126128 or later

Player 2.5.x any 2.5.1 build 126130 or later
Player 2.0.x any upgrade to at least 2.5.1
Player 1.0.x any 1.0.9 build 126128 or later

ACE 2.5.x Windows 2.5.1 build 126130 or later
ACE 2.0.x Windows upgrade to at least 2.5.1
ACE 1.x Windows 1.0.8 build 125922 or later

Server 2.x any 2.0.1 build 156745 or later
Server 1.x any 1.0.8 build 126538 or later

Fusion 2.x Mac OS/X 2.0.1 build 128865 or later
Fusion 1.x Mac OS/X upgrade to at least 2.0.1

ESXi 3.5 ESXi ESXe350-200811401-O-SG

ESX 3.5 ESX ESX350-200811401-SG
ESX 3.0.3 ESX ESX303-200811401-BG
ESX 3.0.2 ESX ESX-1006980

The vendor's advisory is available at:

http://www.vmware.com/security/advisories/VMSA-2009-0005.html

Vendor URL:  www.vmware.com/security/advisories/VMSA-2009-0005.html (Links to External Site)
Cause:   Not specified
Underlying OS:   Linux (Any), UNIX (OS X), Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Fri, 03 Apr 2009 22:01:22 -0700
Subject:  [Security-announce] VMSA-2009-0005 VMware Hosted products,

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2009-0005
Synopsis:          VMware Hosted products, VI Client and patches for ESX
                   and ESXi resolve multiple security issues
Issue date:        2009-04-03
Updated on:        2009-04-03 (initial release of advisory)
CVE numbers:       CVE-2008-4916 CVE-2008-3761 CVE-2009-1146
                   CVE-2009-1147 CVE-2009-0909 CVE-2009-0910
                   CVE-2009-0908 CVE-2009-0177 CVE-2009-0518
- ------------------------------------------------------------------------

1. Summary

   Updated VMware Hosted products, VI Client and patches for ESX and
   ESXi resolve multiple security issues.   

2. Relevant releases

   VMware Workstation 6.5.1 and earlier,
   VMware Player 2.5.1 and earlier,
   VMware ACE 2.5.1 and earlier,
   VMware Server 2.0,
   VMware Server 1.0.8 and earlier,

   VMware ESXi 3.5 without patches ESXe350-200811401-O-SG,
                                   ESXe350-200903201-O-UG

   VMware ESX 3.5 without patches ESX350-200811401-SG,
                                  ESX350-200903201-UG

   VMware ESX 3.0.3 without patch ESX303-200811401-BG

   VMware ESX 3.0.2 without patch ESX-1006980

   NOTE: General Support for Workstation version 5.x ended on
   2009-03-19. Users should plan to upgrade to the latest
   Workstation version 6.x release.

   Extended support for ESX 3.0.2 Update 1 ends on 2009-08-08.
   Users should plan to upgrade to ESX 3.0.3 and preferably to
   the newest release available.

3. Problem Description

 a. Denial of service guest to host vulnerability in a virtual device

    A vulnerability in a guest virtual device driver, could allow a
    guest operating system to crash the host and consequently any
    virtual machines on that host.

    VMware would like to thank Andrew Honig of the Department of
    Defense for reporting this issue.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2008-4916 to this issue.

    The following table lists what action remediates the vulnerability
    (column 4) if a solution is available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    Workstation    6.5.x     any      6.5.1 build 126130 or later
    Workstation    6.0.x     any      upgrade to at least 6.5.1
    Workstation    5.5.x     any      5.5.9 build 126128 or later

    Player         2.5.x     any      2.5.1 build 126130 or later
    Player         2.0.x     any      upgrade to at least 2.5.1
    Player         1.0.x     any      1.0.9 build 126128 or later

    ACE            2.5.x     Windows  2.5.1 build 126130 or later
    ACE            2.0.x     Windows  upgrade to at least 2.5.1
    ACE            1.x       Windows  1.0.8 build 125922 or later

    Server         2.x       any      2.0.1 build 156745 or later
    Server         1.x       any      1.0.8 build 126538 or later

    Fusion         2.x       Mac OS/X 2.0.1 build 128865 or later
    Fusion         1.x       Mac OS/X upgrade to at least 2.0.1

    ESXi           3.5       ESXi     ESXe350-200811401-O-SG

    ESX            3.5       ESX      ESX350-200811401-SG
    ESX            3.0.3     ESX      ESX303-200811401-BG
    ESX            3.0.2     ESX      ESX-1006980
    ESX            2.5.5     ESX      not affected

 b. Windows-based host denial of service vulnerability in hcmon.sys

    A vulnerability in an ioctl in hcmon.sys could be used to create
    a denial of service on a Windows-based host. This issue can only
    be exploited by a privileged Windows account.

    VMware would like to thank Nikita Tarakanov for reporting this
    issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2009-1146 to this issue.

    Note: newly released hosted products (see table in this section)
    address another potential denial of service in hcmon.sys as well.
    Also this issue can only be exploited by a privileged Windows
    account.
 
    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2008-3761 to this issue.

    The following table lists what action remediates the vulnerability
    (column 4) if a solution is available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    Workstation    6.5.x     Windows  6.5.2 build 156735 or later
    Workstation    6.5.x     Linux    not affected
    Workstation    6.0.x     Windows  upgrade to at least 6.5.2
    Workstation    6.0.x     Linux    not affected

    Player         2.5.x     Windows  2.5.2 build 156735 or later
    Player         2.5.x     Linux    not affected
    Player         2.0.x     Windows  upgrade to at least 2.5.2
    Player         2.0.x     Linux    not affected

    ACE            2.5.x     Windows  2.5.2 build 156735 or later
    ACE            2.0.x     Windows  upgrade to at least 2.5.2

    Server         2.x       Windows  2.0.1 build 156745 or later
    Server         2.x       Linux    not affected
    Server         1.x       Windows  1.0.9 build 156507 or later
    Server         1.x       Linux    not affected

    Fusion         2.x       Mac OS/X not affected

    ESXi           3.5       ESXi     not affected

    ESX            3.5       ESX      not affected
    ESX            3.0.3     ESX      not affected
    ESX            3.0.2     ESX      not affected
    ESX            2.5.5     ESX      not affected

 c. A VMCI privilege escalation on Windows-based hosts or Windows-
    based guests.

    The Virtual Machine Communication Interface (VMCI) is an
    infrastructure that provides fast and efficient communication
    between a virtual machine and the host operating system and
    between two or more virtual machines on the same host.

    A vulnerability in vmci.sys could allow privilege escalation on
    Windows-based machines. This could occur on Windows-based hosts or
    inside Windows-based guest operating systems.  
 
    Current versions of ESX do not support the VMCI interface and
    hence they are not affected by this vulnerability.
   
    Note: Installing the new hosted releases will not remediate the
    issue on Windows-based guests. The VMware Tools packages will need
    to be updated on each Windows-based guest followed by a reboot
    of the guest system.

    VMware would like to thank Nikita Tarakanov for reporting this
    issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CVE-2009-1147 to this issue.

    Refer to VMware KB article 1009826 on the steps that are needed to
    remediate this vulnerability on Windows-based hosts. This KB article
    is found at http://kb.vmware.com/kb/1009826.

    The following table lists what action remediates the vulnerability
    on Windows-based guests (column 4) if a solution is available.
    
    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    Workstation    6.5.x     Windows  6.5.2 build 156735 or later
    Workstation    6.5.x     Linux    not affected
    Workstation    6.0.x     Windows  upgrade to at least 6.5.2
    Workstation    6.0.x     Linux    not affected

    Player         2.5.x     Windows  2.5.2 build 156735 or later
    Player         2.5.x     Linux    not affected
    Player         2.0.x     Windows  upgrade to at least 2.5.2
    Player         2.0.x     Linux    not affected

    ACE            2.5.x     Windows  2.5.2 build 156735 or later
    ACE            2.0.x     Windows  upgrade to at least 2.5.2

    Server         2.x       Windows  2.0.1 build 156745 or later
    Server         2.x       Linux    not affected
    Server         1.x       any      not affected

    Fusion         2.x       Mac OS/X not affected

    ESXi           3.5       ESXi     not affected

    ESX            3.5       ESX      not affected
    ESX            3.0.3     ESX      not affected
    ESX            3.0.2     ESX      not affected
    ESX            2.5.5     ESX      not affected

 d. VNnc Codec Heap Overflow vulnerabilities

    The VNnc Codec assists in Record and Replay sessions. Record and
    Replay record the dynamic virtual machine state over a period of
    time.

    Two heap overflow vulnerabilities could allow a remote attacker to
    execute arbitrary code on VMware hosted products. For an attack to
    be successful the user must be tricked into visiting a malicious web
    page or opening a malicious video file.

    VMware would like to thank Aaron Portnoy from TippingPoint DVLabs
    for reporting these issues to us. TippingPoint has issued the
    following identifiers: ZDI-CAN-435, ZDI-CAN-436.

    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    has assigned the names CVE-2009-0909 and CVE-2009-0910 to these
    issues.

    The following table lists what action remediates the vulnerability
    (column 4) if a solution is available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    Workstation    6.5.x     any      6.5.2 build 156735 or later
    Workstation    6.0.x     any      not affected

    Player         2.5.x     any      2.5.X build 156735 or later
    Player         2.0.x     any      not affected

    ACE            2.5.x     Windows  2.5.2 build 156735 or later
    ACE            2.0.x     Windows  upgrade to at least 2.5.2

    Server         2.x       any      2.0.1 build 156745 or later
    Server         1.x       any      not affected

    Fusion         2.x       Mac OS/X not affected
    Fusion         1.x       Mac OS/X not affected

    ESXi           3.5       ESXi     not affected

    ESX            3.5       ESX      not affected
    ESX            3.0.3     ESX      not affected
    ESX            3.0.2     ESX      not affected
    ESX            2.5.5     ESX      not affected

 e. ACE shared folders vulnerability

    The VMware Host Guest File System (HGFS) shared folders feature allows
    users to transfer data between a guest operating system and the
    non-virtualized host operating system that contains it.

    A vulnerability in ACE shared folders could allow a previously disabled
    and not removed shared folder in the guest to be enabled by a non ACE
    Administrator.
      
    VMware would like to thank Emmanouel Kellinis, KPMG London, penetration
    testing team for reporting this issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    has assigned the name CVE-2009-0908 to this issue.

    The following table lists what action remediates the vulnerability
    (column 4) if a solution is available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    Workstation    6.x.x     any      not affected

    Player         2.5.x     any      not affected

    ACE            2.5.x     Windows  2.5.2 build 156735 or later
    ACE            2.0.x     Windows  upgrade to at least 2.5.2

    Server         any       any      not affected

    Fusion         any       Mac OS/X not affected

    ESXi           3.5       ESXi     not affected

    ESX            3.5       ESX      not affected
    ESX            3.0.3     ESX      not affected
    ESX            2.5.5     ESX      not affected

 f. A remote denial of service vulnerability in authd for Windows
    based hosts.

    A vulnerability in vmware-authd.exe could cause a denial
    of service condition on Windows hosts.

    The Common Vulnerabilities and Exposures Project (cve.mitre.org)
    has assigned the name CVE-2009-0177 to this issue.
 
    The following table lists what action remediates the vulnerability
    (column 4) if a solution is available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    Workstation    6.5.x     Windows  6.5.2 build 156735 or later
    Workstation    6.5.x     Linux    not affected
    Workstation    6.0.x     Windows  upgrade to at least 6.5.2
    Workstation    6.0.x     Linux    not affected

    Player         2.5.x     Windows  2.5.2 build 156735 or later
    Player         2.5.x     Linux    not affected
    Player         2.0.x     Windows  upgrade to at least 2.5.2
    Player         2.0.x     Linux    not affected

    ACE            2.5.x     Windows  2.5.2 build 156735 or later
    ACE            2.0.x     Windows  upgrade to at least 2.5.2

    Server         2.x       Windows  2.0.1 build 156745 or later
    Server         2.x       Linux    not affected
    Server         1.x       any      not affected

    Fusion         2.x       Mac OS/X 2.0.2 build 147997 or later

    ESXi           3.5       ESXi     not affected

    ESX            3.5       ESX      not affected
    ESX            3.0.3     ESX      not affected
    ESX            3.0.2     ESX      not affected
    ESX            2.5.5     ESX      not affected

g. VI Client Retains VirtualCenter Server Password in Memory

    After logging in to VirtualCenter Server with VI Client, the
    password for VirtualCenter Server might be present in the memory
    of the VI Client.

    Note: This vulnerability is present in VI Client and in order to
    remediate the vulnerability, you will need to replace VI Client
    with a fixed version (see below).

    VMware would like to thank Craig Marshall for reporting this
    issue to us.

    The Common Vulnerabilities and Exposures Project (cve.mitre.org)
    has assigned the name CVE-2009-0518 to this issue.
 
    To determine if your copy of VI Client is not vulnerable, check the
    about box under the help menu of VI Client. Your copy is not
    vulnerable if this box mentions one of the following:
    - ESX 2.5.5,
    - ESX 3.0,
    - VC build number 147704, 147694, or 147633 (or higher).

    A VI Client copy that remediates the problem can be obtained from:
    - VirtualCenter 2.5 Update 4,
    - ESXi 3.5 after applying patch ESXe350-200903201-O-UG
      (this patch is part of the ESXi 3.5 Update 4 release),
    - ESX 3.5 after applying patch ESX350-200903201-UG
      (this patch is part of the ESX 3.5 Update 4 release).


4. Solution

   Please review the patch/release notes for your product and version
   and verify the md5sum and/or the sha1sum of your downloaded file.

   VMware Workstation 6.5.2
   ------------------------
   http://www.vmware.com/download/ws/
   Release notes:
   http://www.vmware.com/support/ws65/doc/releasenotes_ws652.html

   For Windows

   Workstation for Windows 32-bit and 64-bit
   Windows 32-bit and 64-bit .exe
   md5sum: 8336586b9f9e5180d5279a0b988e82a6
   sha1sum: ccdb6bcb867638e8f4f493bc02c6f70c5ebbb88e

   For Linux

   Workstation for Linux 32-bit
   Linux 32-bit .rpm
   md5sum: 69b039c848f6b2c94948928d8e9057bb
   sha1sum: 37ca77ef550db932cf7b078fcbd6fa0155e3411e

   Workstation for Linux 32-bit
   Linux 32-bit .bundle
   md5sum: 5d4ccf9c23701d09a671f586a9bb4190
   sha1sum: d508111adf479d82049c323b1d0b82200c0ab4dd

   Workstation for Linux 64-bit
   Linux 64-bit .rpm
   md5sum: 19387416e3b597b901dfe84e4a2bcd97
   sha1sum: 0726518abc9a77051d991af570774bae1625ff78

   Workstation for Linux 64-bit
   Linux 64-bit .bundle
   md5sum: 56dfc3adcf96701f440b19a8cf06c3df
   sha1sum: 04aa442a2b9bf2c67d6266a410b20ef146b93bef


   VMware Player 2.5.2
   -------------------
   http://www.vmware.com/download/player/
   Release notes:
   http://www.vmware.com/support/player25/doc/releasenotes_player252.html

   Player for Windows binary
 
http://download3.vmware.com/software/vmplayer/VMware-player-2.5.2-156735.ex
e
   md5sum: 01356d729e9b031c8904e9560a02c469

   Player for Linux (.rpm)
 
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.2-156735.i3
86.rpm
   md5sum: aa047047b72de7f4b53d9c2128b53bec

   Player for Linux (.bundle)
 
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.2-156735.i3
86.bundle
   md5sum: bd51e8f8ef2417080c6d734f6ea9fb87

   VMware Player 2.5.2 - 64-bit (.rpm)
 
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.2-156735.x8
6_64.rpm
   md5sum: 5b488b97b5091d3980eb74ec0a5c065b

   VMware Player 2.5.2 - 64-bit (.bundle)
 
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.2-156735.x8
6_64.bundle
   md5sum: 25254cd60c4063c2c68a8bf50c2c4869


   VMware ACE 2.5.2
   ----------------
   http://www.vmware.com/download/ace/
   Release notes:
   http://www.vmware.com/support/ace25/doc/releasenotes_ace252.html

   ACE Management Server Virtual Appliance
   AMS Virtual Appliance .zip
   md5sum: 430ff7792d9d490d1678fc22b4c62121
   sha1sum: 98b74e0dba4214b055c95ccea656bfa2731c3fee

   VMware ACE for Windows 32-bit and 64-bit
   Windows 32-bit and 64-bit .exe
   md5sum: 8336586b9f9e5180d5279a0b988e82a6

   ACE Management Server for Windows
   Windows .exe
   md5sum: 44918519a7bac2501b211c9825ed8268
   sha1sum: 97655c824815f7c4e25f6940c708f835ab616da9

   ACE Management Server for SUSE Enterprise Linux 9
   SLES 9 .rpm
   md5sum: 7fcb0409474c7e81accc90f25d80b00e
   sha1sum: 385b254930dd6b8c53e3c805653c1fa1b07a6161

   ACE Management Server for Red Hat Enterprise Linux 4
   RHEL 4 .rpm
   md5sum: 745e3115f8557fa04c2ddaf25320a911
   sha1sum: ef75d572325a32a7582dbb4c352541978d3cebeb


   VMware Server 2.0.1
   -------------------
   http://www.vmware.com/download/server/
   Release notes:
   http://www.vmware.com/support/server2/doc/releasenotes_vmserver201.html

   For Windows

   VMware Server 2
   Version 2.0.1 | 156745 - 03/31/09    
   507 MB EXE image VMware Server 2 for Windows Operating Systems. A
   master installer file containing all Windows components of VMware
   Server.
   md5sum: d0eefaa79e42d13a693c4d732a460ba4

   VIX API 1.6 for Windows.
   Version 1.6.2 | 156745 - 03/31/09    37 MB EXE image
   md5sum: ad531ed3c37c0a50fb915981f83ca133

   For Linux

   VMware Server 2 for Linux Operating Systems.
   Version 2.0.1 | 156745 - 03/31/09    465 MB RPM image
   md5sum: eb42331bbd9be30848826b8cab73e0ca

   VMware Server 2 for Linux Operating Systems.
   Version 2.0.1 | 156745 - 03/31/09    466 MB TAR image
   md5sum: be96bc1696f4cef67755bfd2553ce233

   VMware Server 2 for Linux Operating Systems 64-bit version.
   Version 2.0.1 | 156745 - 03/31/09    434 MB RPM image
   md5sum: 697a792c70d50e98a347c06b323bd20b

   The core application needed to run VMware Server 2, 64-bit version.
   Version 2.0.1 | 156745 - 03/31/09    436 MB TAR image
   md5sum: f40498229772910d6a6788b7803f9c38

   VIX API 1.6 for Linux.
   Version 1.6.2 | 156745 - 03/31/09    17 MB TAR image
   md5sum: 2ef6174b90cdd9a2832b57dbe94cfbb1

   64-bit VIX API 1.6 for Linux.
   Version 1.6.2 | 156745 - 03/31/09    21 MB TAR image
   md5sum: 454aeba273f9a89c578223c95b262323


   VMware Server 1.0.9
   -------------------
   http://www.vmware.com/download/server/
   Release notes:
   http://www.vmware.com/support/server/doc/releasenotes_server.html

   VMware Server for Windows 32-bit and 64-bit
 
http://download3.vmware.com/software/vmserver/VMware-server-installer-1.0.9
- -156507.exe
   md5sum: 8c650f8a0a0521b69c6aba00d910cfb9

   VMware Server Windows client package
 
http://download3.vmware.com/software/vmserver/VMware-server-win32-client-1.
0.9-156507.zip
   md5sum: c83e673f7422a4f3edaf7d9337cf5d6d

   VMware Server for Linux
 
http://download3.vmware.com/software/vmserver/VMware-server-1.0.9-156507.ta
r.gz
   md5sum: ff4b57588514c83b1a828e3b19843ad2

   VMware Server for Linux rpm
 
http://download3.vmware.com/software/vmserver/VMware-server-1.0.9-156507.i3
86.rpm
   md5sum: c8fc9e9f948f2807b9f8bfb3ca318f36

   Management Interface
 
http://download3.vmware.com/software/vmserver/VMware-mui-1.0.9-156507.tar.g
z
   md5sum: dbf99faef8bd26e173cf2514d7bea449

   VMware Server Linux client package
 
http://download3.vmware.com/software/vmserver/VMware-server-linux-client-1.
0.9-156507.zip
   md5sum: 7e76a481408454a747bb4d076a6e2524

   
   VirtualCenter
   -------------
   VMware VirtualCenter 2.5 Update 4
   www.vmware.com/download/download.do
   DVD iso image
   md5sum: 4304334ed7662b6a43646e6dde0956d2
   Zip file
   md5sum: 1306cb9b25e28a06bab84257d7cbf38f
   Release Notes
   www.vmware.com/support/vi3/doc/vi3_vc25u4_rel_notes.html

   
   ESXi
   ----
   ESXi 3.5 patch ESXe350-200811401-O-SG (guest virtual device driver)
   http://download3.vmware.com/software/vi/ESXe350-200811401-O-SG.zip
   md5sum: e895c8cb0d32b722d7820d0214416092
   http://kb.vmware.com/kb/1007508

   ESXi 3.5 patch ESXe350-200903201-O-UG (VI Client)
   http://download3.vmware.com/software/vi/ESXe350-200903201-O-UG.zip
   md5sum: 45632da28812837bb00cee86af85b8a5
   http://kb.vmware.com/kb/1007992

   NOTES: ESXi 3.5 patch ESXe350-200903201-O-UG supercedes
          ESXe350-200811401-O-SG

          The three ESXi patches for Firmware "I", VMware Tools "T,"
          and the VI Client "C" are contained in a single offline "O"
          download file.


   ESX
   ---
   ESX 3.5 patch ESX350-200811401-SG (guest virtual device driver)
   http://download3.vmware.com/software/vi/ESX350-200811401-SG.zip
   md5sum: 988042ce20ce2381216fbe1862c3e66d
   http://kb.vmware.com/kb/1007501
 
   ESX 3.5 patch ESX350-200903201-UG (VI Client)
   http://download3.vmware.com/software/vi/ESX350-200903201-UG.zip
   md5sum: 650fa096cf270ec58d38e9ff41c661aa
   http://kb.vmware.com/kb/1007971

   ESX 3.0.3 patch ESX303-200811401-BG (guest virtual device driver)
   http://download3.vmware.com/software/vi/ESX303-200811401-BG.zip
   md5sum: 26bf687a3483951d1f14ab66edf1d196
   http://kb.vmware.com/kb/1006986

   ESX 3.0.2 patch ESX-1006980 (guest virtual device driver)
   http://download3.vmware.com/software/vi/ESX-1006980.tgz
   md5sum: 5e73f1585fea3ee770b2df2b94e73ca4
   http://kb.vmware.com/kb/1006980


5. References

   CVE numbers
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4916
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3761
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1146
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1147
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0909
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0910
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0908
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0177
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0518
 
- ------------------------------------------------------------------------
6. Change log

2009-04-03  VMSA-2009-0005
Initial security advisory after hosted product releases on 2009-04-01.
Relevant patches for ESXi, ESX 3.5, ESX 3.0.3, ESX 3.0.2 were released
previously.

- -----------------------------------------------------------------------
7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

  * security-announce at lists.vmware.com
  * bugtraq at securityfocus.com
  * full-disclosure at lists.grok.org.uk

E-mail:  security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2009 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8

wj8DBQFJ1umYS2KysvBH1xkRAp/GAJ9tobntigYjyJUVLDlZxUNGkDMTGACfXKT6
hDT6IzJfMUD95LDNPpZ+Ax8=
=Lott
-----END PGP SIGNATURE-----

_______________________________________________
Security-announce mailing list
Security-announce@lists.vmware.com
http://lists.vmware.com/mailman/listinfo/security-announce

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC