VMSA-2010-0015.1

VMware ESX third party updates for Service Console

1. Summary

ESX 4.x Console OS (COS) updates for NSS_db, OpenLDAP, cURL, sudo OpenSSL, GnuTLS, NSS and NSPR packages.

2. Relevant releases

VMware ESX 4.1 without patches ESX410-201010402-SG, ESX410-201010404-SG, ESX410-201010410-SG

VMware ESX 4.0 without patches ESX400-201009407-SG, ESX400-201009408-SG, ESX400-201009409-SG, ESX400-201009410-SG, ESX400-201009401-SG

Notes:
Effective May 2010, VMware's patch and update release program during Extended Support will be continued with the condition that all subsequent patch and update releases will be based on the latest baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1, ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section "End of Product Availability FAQs" at http://www.vmware.com/support/policies/lifecycle/vi/faq.html for details.

Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan to upgrade to at least ESX 3.5 and preferably to the newest release available.

3. Problem Description

a. Service Console update for NSS_db

The service console package NSS_db is updated to version nss_db-2.2-35.4.el5_5.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0826 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

b. Service Console update for OpenLDAP

The service console package OpenLDAP updated to version 2.3.43-12.el5.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-3767 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

c. Service Console update for cURL

The service console packages for cURL updated to version 7.15.5-9.el5.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

d. Service Console update for sudo

The service console package sudo updated to version 1.7.2p1-7.el5_5.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-1646 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.

e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR

Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2 and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8, and NSS to version 3.12.6-1.3235.vmw and NSPR to version 4.8.4-1.3235.vmw. These four updates are bundled together due to their mutual dependencies.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245 and CVE-2010-0433 to the issues addressed in this update.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

* hosted products are VMware Workstation, Player, ACE, Server, Fusion.
** Note: This patch also addresses non-security issues. See the KB article for each patch.

4. Solution

Please review the patch/release notes for your product and version and verify the md5sum of your downloaded file.

ESX 4.1
-------
ESX410-201010001
Download link:
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-252-20101109-182791/ESX410-201010001.zip
md5sum: ff4435fd3c74764f064e047c6e5e7809
sha1sum: 322981f4dbb9e5913c8f38684369444ff7e265b3
http://kb.vmware.com/kb/1027027

ESX410-201010001 contains the following security bulletins:
ESX410-201010401-SG (COS kernel)
http://kb.vmware.com/kb/1027013
ESX410-201010419-SG (Likewise)
http://kb.vmware.com/kb/1027026
ESX410-201010404-SG (NSS)
http://kb.vmware.com/kb/1027016
ESX410-201010409-SG (tar)
http://kb.vmware.com/kb/1027019
ESX410-201010412-SG (Perl)
http://kb.vmware.com/kb/1027022
ESX410-201010413-SG (cpio)
http://kb.vmware.com/kb/1027023
ESX410-201010410-SG (cURL)
http://kb.vmware.com/kb/1027020
ESX410-201010401-SG (vmkernel64, VMX, CIM)

http://kb.vmware.com/kb/1027013
ESX410-201010414-SG (vmware-esx-pam-config)

http://kb.vmware.com/kb/1027024
ESX410-201010402-SG (GnuTLS, NSS, and openSSL)

http://kb.vmware.com/kb/1027014

ESX410-201010001 also contains the following non-security bulletins
ESX410-201010405-BG ESX410-201010415-BG

To install an individual bulletin use esxupdate with the -b option.

ESX 4.0
-------
ESX400-201009001
Download link:
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-240-20100919-359479/ESX400-201009001.zip
md5sum: 988c593b7a7abf0be5b72970ac64a369
sha1sum: 26d875955b01c19f4e56703216e135257c08836f
http://kb.vmware.com/kb/1025321

ESX400-201009001 contains the following security bulletins:
ESX400-201009407-SG (NSS_db)
http://kb.vmware.com/kb/1023763
ESX400-201009408-SG (OpenLDAP)
http://kb.vmware.com/kb/1023764
ESX400-201009409-SG (cURL)
http://kb.vmware.com/kb/1023765
ESX400-201009410-SG (sudo)
http://kb.vmware.com/kb/1023766
ESX400-201009401-SG (OpenSSL, GnuTLS, NSS)

http://kb.vmware.com/kb/1023759

And contains the following security bundles from VMSA-2010-0013.1:
ESX400-201009402-SG (cpio)
http://kb.vmware.com/kb/1023760
ESX400-201009406-SG (tar)
http://kb.vmware.com/kb/1023762
ESX400-201009403-SG (krb5)
http://kb.vmware.com/kb/1023761
ESX400-201009411-SG (perl)
http://kb.vmware.com/kb/1023767

And also contains ESX400-201009412-BG a non-security critical update.

To install an individual bulletin use esxupdate with the -b option.

5. References

CVE numbers
http://cve.mitre.org/cgi-bin/cvename.cgi
http://cve.mitre.org/cgi-bin/cvename.cgi
http://cve.mitre.org/cgi-bin/cvename.cgi
http://cve.mitre.org/cgi-bin/cvename.cgi
http://cve.mitre.org/cgi-bin/cvename.cgi
http://cve.mitre.org/cgi-bin/cvename.cgi
http://cve.mitre.org/cgi-bin/cvename.cgi
http://cve.mitre.org/cgi-bin/cvename.cgi

6. Change log

2010-09-30 VMSA-2010-0015
Initial security advisory after release of patches for ESX 4.0
on 2010-09-30
2010-11-16 VMSA-2010-0015.1
Added ESX 4.1 patch information on 2010-11-15.

7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

• security-announce at lists.vmware.com
• bugtraq at securityfocus.com
• full-disclosure at lists.grok.org.uk