VMSA-2008-0004:Updated e2fsprogs service console package
VMSA-2008-0004.1
Updated e2fsprogs service console package
VMware Security Advisory
1. Summary
Updated service console package e2fsprogs.
2. Relevant releases
VMware ESX 3.5 without patch ESX350-200803214-UG
VMware ESX 3.0.2 without patch ESX-1003523
VMware ESX 3.0.1 without patch ESX-1003517
ESX Server 2.5.5 Upgrade Patch 5
ESX Server 2.5.4 Upgrade Patch 16
NOTE: ESX 3.0.1 is in Extended Support and its end of support (Security and Bug fixes) is 07/31/2008. Users should plan to upgrade to at least 3.0.2 update 1 and preferably the newest release available before the end of extended support.
NOTE: ESX 2.5.4 is in Extended Support and its end of support (Security and Bug fixes) is 10/08/2008. Users should plan to upgrade to at least 2.5.5 and preferably the newest release available before the end of extended support.
ESX Server versions 3.0.0 and prior to 2.5.4 are no longer in Extended Support. Users should upgrade to a supported version of the product.
The VMware Infrastructure Support Life Cycle Policy can be found here: www.vmware.com/support/policies/eos_vi.html
3. Problem description
Updated e2fsprogs package address multiple integer overflow flaws
Thanks to Rafal Wojtczuk of McAfee Avert Research for identifying and reporting this issue.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-5497 to this issue.
4. Solution
Please review the Patch notes for your product and version and verify the md5sum of your downloaded file.
ESX 3.5 Patch ESX350-200803214-UG
download3.vmware.com/software/esx/ESX350-200803214-UG.zip
md5sum: 9ff7b416afed3acfbfbb5d1d63ca5060
kb.vmware.com/kb/1003721
VMware ESX 3.0.2 patch ESX-1003523
download3.vmware.com/software/vi/ESX-1003523.tgz
md5sum: 13cf97c1b44449658ad1057b2c1bfbab
kb.vmware.com/kb/1003523
VMware ESX 3.0.1 patch ESX-1003517
download3.vmware.com/software/vi/ESX-1003517.tgz
md5sum: a3229df6e7711c8b89ef2d82aa825cab
kb.vmware.com/kb/1003517
ESX Server 2.5.5 Upgrade Patch 5
download3.vmware.com/software/esx/esx-2.5.5-73417-upgrade.tar.gz
md5sum: cf0addac42cb2057c47065971f56bee6
www.vmware.com/support/esx25/doc/esx-255-200802-patch.html
ESX Server 2.5.4 Upgrade Patch 16
download3.vmware.com/software/esx/esx-2.5.4-73416-upgrade.tar.gz
md5sum: b7b2cbfd45380124c128831dca8bc2b0
www.vmware.com/support/esx25/doc/esx-254-200802-patch.html
5. References
CVE numbers
cve.mitre.org/cgi-bin/cvename.cgi
6. Change log
2008-03-28 VMSA-2008-0004 Initial release
2008-04-11 VMSA-2008-0004.1 Added patch information for
ESX 3.0.1, ESX 3.0.2, ESX 3.5
for patch release on 2008-04-10
7. Contact
E-mail list for product security notifications and announcements:
lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
PGP key at: kb.vmware.com/kb/1055
Security web site
www.vmware.com/security
VMware security response policy
www.vmware.com/support/policies/security_response.html
General support life cycle policy
www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
www.vmware.com/support/policies/eos_vi.html