VMSA-2008-0004.1

Updated e2fsprogs service console package

1. Summary

Updated service console package e2fsprogs.

2. Relevant releases

VMware ESX 3.5 without patch ESX350-200803214-UG

VMware ESX 3.0.2 without patch ESX-1003523
VMware ESX 3.0.1 without patch ESX-1003517

ESX Server 2.5.5 Upgrade Patch 5
ESX Server 2.5.4 Upgrade Patch 16

NOTE: ESX 3.0.1 is in Extended Support and its end of support (Security and Bug fixes) is 07/31/2008. Users should plan to upgrade to at least 3.0.2 update 1 and preferably the newest release available before the end of extended support.

NOTE: ESX 2.5.4 is in Extended Support and its end of support (Security and Bug fixes) is 10/08/2008. Users should plan to upgrade to at least 2.5.5 and preferably the newest release available before the end of extended support.

ESX Server versions 3.0.0 and prior to 2.5.4 are no longer in Extended Support. Users should upgrade to a supported version of the product.

The VMware Infrastructure Support Life Cycle Policy can be found here: www.vmware.com/support/policies/eos_vi.html

3. Problem description

Updated e2fsprogs package address multiple integer overflow flaws

Thanks to Rafal Wojtczuk of McAfee Avert Research for identifying and reporting this issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-5497 to this issue.

4. Solution

Please review the Patch notes for your product and version and verify the md5sum of your downloaded file.

ESX 3.5 Patch ESX350-200803214-UG
download3.vmware.com/software/esx/ESX350-200803214-UG.zip

md5sum: 9ff7b416afed3acfbfbb5d1d63ca5060
kb.vmware.com/kb/1003721

VMware ESX 3.0.2 patch ESX-1003523
download3.vmware.com/software/vi/ESX-1003523.tgz

md5sum: 13cf97c1b44449658ad1057b2c1bfbab
kb.vmware.com/kb/1003523

VMware ESX 3.0.1 patch ESX-1003517
download3.vmware.com/software/vi/ESX-1003517.tgz

md5sum: a3229df6e7711c8b89ef2d82aa825cab
kb.vmware.com/kb/1003517

ESX Server 2.5.5 Upgrade Patch 5
download3.vmware.com/software/esx/esx-2.5.5-73417-upgrade.tar.gz

md5sum: cf0addac42cb2057c47065971f56bee6
www.vmware.com/support/esx25/doc/esx-255-200802-patch.html

ESX Server 2.5.4 Upgrade Patch 16
download3.vmware.com/software/esx/esx-2.5.4-73416-upgrade.tar.gz

md5sum: b7b2cbfd45380124c128831dca8bc2b0

www.vmware.com/support/esx25/doc/esx-254-200802-patch.html

5. References

CVE numbers

cve.mitre.org/cgi-bin/cvename.cgi

6. Change log

2008-03-28 VMSA-2008-0004 Initial release

2008-04-11 VMSA-2008-0004.1 Added patch information for

ESX 3.0.1, ESX 3.0.2, ESX 3.5

for patch release on 2008-04-10

7. Contact

E-mail list for product security notifications and announcements:
lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

• security-announce at lists.vmware.com
• bugtraq at securityfocus.com
• full-disclosure at lists.grok.org.uk