VMSA-2008-0017:Updated ESX packages for libxml2, ucd-snmp, libtiff

VMware

0 more products

23364

29 October 2008

29 October 2008

CLOSED

MEDIUM

CVE-2008-3281,CVE-2008-0960,CVE-2008-2327

VMSA-2008-0017.2

Updated ESX packages for libxml2, ucd-snmp, libtiff

VMware Security Advisory
 
VMware Security Advisory Advisory ID:
VMSA-2008-0017.2
VMware Security Advisory Synopsis:
 Updated ESX packages for libxml2, ucd-snmp, libtiff
VMware Security Advisory Issue date:
 2008-10-31
VMware Security Advisory Updated on:
 2008-12-02
VMware Security Advisory CVE numbers:
 CVE-2008-3281 CVE-2008-0960 CVE-2008-2327
CVE-2008-3529
1. Summary


Updated ESX packages for libxml2, ucd-snmp, libtiff.

 
2. Relevant releases


ESX 3.0.3 without patch ESX303-200810503-SG
ESX 3.0.2 without patch ESX-1006968
ESX 2.5.5 before Upgrade Patch 10
ESX 2.5.4 before Upgrade Patch 21

NOTE: Extended support (Security and Bug fixes) for ESX 3.0.2 ended
on 2008-10-29. Extended support (Security and Bug fixes) for
ESX 2.5.4 ended on 2008-10-08.

Extended support for ESX 3.0.2 Update 1 ends on 2009-08-08. Users
should plan to upgrade to ESX 3.0.3 and preferably to the newest
release available.

 

3. Problem Description

a. Updated ESX Service Console package libxml2

A denial of service flaw was found in the way libxml2 processes
certain content. If an application that is linked against
libxml2 processes malformed XML content, the XML content might
cause the application to stop responding.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-3281 to this issue.
Additionally the following was also fixed, but was missing in the
security advisory.
A heap-based buffer overflow flaw was found in the way libxml2
handled long XML entity names. If an application linked against
libxml2 processed untrusted malformed XML content, it could cause
the application to crash or, possibly, execute arbitrary code.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-3529 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.

VMware Product
Product Version
Running on
Replace with/ Apply Patch
VMware ProductVirtualCenter
Product Versionany
Running on Windows
Replace with/ Apply Patchnot affected
VMware Producthosted
Product Versionany
Running on any
Replace with/ Apply Patchnot affected
VMware ProductESXi
Product Version3.5
Running on ESXi
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version3.5
Running on ESX
Replace with/ Apply PatchESX350-200811405-SG
VMware ProductESX
Product Version3.0.3
Running on ESX
Replace with/ Apply PatchESX303-200810503-SG
VMware ProductESX
Product Version3.0.2
Running on ESX
Replace with/ Apply PatchESX-1006968
VMware ProductESX
Product Version2.5.5
Running on ESX
Replace with/ Apply PatchESX 2.5.5 upgrade patch 10 or later
VMware ProductESX
Product Version2.5.4
Running on ESX
Replace with/ Apply PatchESX 2.5.4 upgrade patch 21



* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

b. Updated ESX Service Console package ucd-snmp

A flaw was found in the way ucd-snmp checks an SNMPv3 packet's
Keyed-Hash Message Authentication Code. An attacker could use
this flaw to spoof an authenticated SNMPv3 packet.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-0960 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.

VMware Product
Product Version
Running on
Replace with/ Apply Patch
VMware ProductVirtualCenter
Product Versionany
Running on Windows
Replace with/ Apply Patchnot affected
VMware Producthosted
Product Versionany
Running on any
Replace with/ Apply Patchnot affected
VMware ProductESXi
Product Version3.5
Running on ESXi
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version3.5
Running on ESX
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version3.0.3
Running on ESX
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version3.0.2
Running on ESX
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version2.5.5
Running on ESX
Replace with/ Apply PatchESX 2.5.5 upgrade patch 10 or later
VMware ProductESX
Product Version2.5.4
Running on ESX
Replace with/ Apply PatchESX 2.5.4 upgrade patch 21



* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

c. Updated third party library libtiff

Multiple uses of uninitialized values were discovered in libtiff's
Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker
could create a carefully crafted LZW-encoded TIFF file that would
cause an application linked with libtiff to crash or, possibly,
execute arbitrary code.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-2327 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.

VMware Product
Product Version
Running on
Replace with/ Apply Patch
VMware ProductVirtualCenter
Product Versionany
Running on Windows
Replace with/ Apply Patchnot affected
VMware Producthosted
Product Versionany
Running on any
Replace with/ Apply Patchnot affected
VMware ProductESXi
Product Version3.5
Running on ESXi
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version3.5
Running on ESX
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version3.0.3
Running on ESX
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version3.0.2
Running on ESX
Replace with/ Apply Patchnot affected
VMware ProductESX
Product Version2.5.5
Running on ESX
Replace with/ Apply PatchESX 2.5.5 upgrade patch 10 or later
VMware ProductESX
Product Version2.5.4
Running on ESX
Replace with/ Apply PatchESX 2.5.4 upgrade patch 21



* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

4. Solution


Please review the patch/release notes for your product and version
and verify the md5sum of your downloaded file.

ESX
---
ESX 3.5 patch ESX350-200811405-SG
http://download3.vmware.com/software/vi/ESX350-200811405-SG
md5sum: d6c676a6809a14268d7f95192a52ea21
http://kb.vmware.com/kb/1007503

ESX 3.0.3 patch ESX303-200810503-SG
http://download3.vmware.com/software/vi/ESX303-200810503-SG.zip
md5sum: e687313e58377be41f6e6b767dfbf268
http://kb.vmware.com/kb/1006971

ESX 3.0.2 patch ESX-1006968
http://download3.vmware.com/software/vi/ESX-1006968.tgz
md5sum: fc9e30cff6f03a209e6a275254fa6719
http://kb.vmware.com/kb/1006968

VMware ESX 2.5.5 Upgrade Patch 10
http://download3.vmware.com/software/esx/esx-2.5.5-119702-upgrade.tar.gz
md5sum: 2ee87cdd70b1ba84751e24c0bd8b4621
http://vmware.com/support/esx25/doc/esx-255-200810-patch.html

VMware ESX 2.5.4 Upgrade Patch 21
http://download3.vmware.com/software/esx/esx-2.5.4-119703-upgrade.tar.gz
md5sum: d791be525c604c852a03dd7df0eabf35
http://vmware.com/support/esx25/doc/esx-254-200810-patch.html

6. Change log


2008-10-31 VMSA-2008-0017
Initial security advisory after release of ESX 3.0.3, ESX 3.0.2, ESX
2.5.5 and ESX 2.5.4 patches on 2008-10-30.
2008-11-17 VMSA-2008-0017.1
Added missing CVE number for libxml2.
2008-12-02 VMSA-2008-0017.2
Added ESX 3.5 patch information after release of patches on 2008-12-02.

7. Contact


E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk

E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html