VMSA-2007-0001
Updated ESX Patches address several security issues.
-------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2007-0001
Synopsis: VMware ESX server security updates
Issue date: 2007-01-08
Updated on: 2007-01-08
CVE: CVE-2006-3589 CVE-2006-2937 CVE-2006-2940
CVE-2006-3738 CVE-2006-4339 CVE-2006-4343
CVE-2006-4980
-------------------------------------------------------------------
1. Summary:
Updated ESX Patches address several security issues.
2. Relevant releases:
VMware ESX 3.0.1 without patch ESX-9986131
VMware ESX 3.0.0 without patch ESX-3069097
VMware ESX 2.5.4 prior to upgrade patch 3
VMware ESX 2.5.3 prior to upgrade patch 6
VMware ESX 2.1.3 prior to upgrade patch 4
VMware ESX 2.0.2 prior to upgrade patch 4
3. Problem description:
Problems addressed by these patches:
a. Incorrect permissions on SSL key files generated by vmware-config (CVE-2006-3589):
ESX 3.0.1: does not have this problem
ESX 3.0.0: does not have this problem
ESX 2.5.4: corrected by ESX 2.5.4 Upgrade Patch 3 (Build# 36502)
ESX 2.5.3: corrected by ESX 2.5.3 Upgrade Patch 6 (Build# 35703)
ESX 2.1.3: corrected by ESX 2.1.3 Upgrade Patch 4 (Build# 35803)
ESX 2.0.2: corrected by ESX 2.0.2 Upgrade Patch 4 (Build# 35801)
A possible security issue with the configuration program
vmware-config which could set incorrect permissions on SSL key
files. Local users may be able to obtain access to the SSL key
files. The Common Vulnerabilities and Exposures project
(cve.mitre.org) assigned the name CVE-2006-3589 to this issue.
b. OpenSSL library vulnerabilities:
ESX 3.0.1: corrected by ESX 3.0.1 Patch ESX-9986131
ESX 3.0.0: corrected by ESX 3.0.0 Patch ESX-3069097
ESX 2.5.4: corrected by ESX 2.5.4 Upgrade Patch 3 (Build# 36502)
ESX 2.5.3: corrected by ESX 2.5.3 Upgrade Patch 6 (Build# 35703)
ESX 2.1.3: corrected by ESX 2.1.3 Upgrade Patch 4 (Build# 35803)
ESX 2.0.2: corrected by ESX 2.0.2 Upgrade Patch 4 (Build# 35801)
(CVE-2006-2937) OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d
allows remote attackers to cause a denial of service (infinite
loop and memory consumption) via malformed ASN.1 structures that
trigger an improperly handled error condition.
(CVE-2006-2940) OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d,
and earlier versions allows attackers to cause a denial of service
(CPU consumption) via parasitic public keys with large (1) "public
exponent" or (2) "public modulus" values in X.509 certificates that
require extra time to process when using RSA signature verification.
(CVE-2006-4339) OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8
before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1
padding before generating a hash, which allows remote attackers to
forge a PKCS #1 v1.5 signature that is signed by that RSA key and
prevents OpenSSL from correctly verifying X.509 and other certificates
that use PKCS #1.
(CVE-2006-4343) The get_server_hello function in the SSLv2 client code
in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier
versions allows remote servers to cause a denial of service (client
crash) via unknown vectors that trigger a null pointer dereference.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
assigned the names CVE-2006-2937, CVE-2006-2940, CVE-2006-3738,
CVE-2006-4339, and CVE-2006-4343 to these issues.
c. Updated OpenSSH package addresses the following possible security issues:
ESX 3.0.1: corrected by Patch ESX-9986131
ESX 3.0.0: corrected by Patch ESX-3069097
ESX 2.5.4: does not have these problems
ESX 2.5.3: does not have these problems
ESX 2.1.3: does not have these problems
ESX 2.0.2: does not have these problems
(CVE-2004-2069) sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other
versions, when using privilege separation, does not properly signal the
non-privileged process when a session has been terminated after exceeding
the LoginGraceTime setting, which leaves the connection open and allows
remote attackers to cause a denial of service (connection consumption).
(CVE-2006-0225) scp in OpenSSH 4.2p1 allows attackers to execute arbitrary
commands via filenames that contain shell metacharacters or spaces, which
are expanded twice.
(CVE-2003-0386) OpenSSH 3.6.1 and earlier, when restricting host access by
numeric IP addresses and with VerifyReverseMapping disabled, allows remote
attackers to bypass "from=" and "user@host" address restrictions by
connecting to a host from a system whose reverse DNS hostname contains
the numeric IP address.
(CVE-2006-4924) sshd in OpenSSH before 4.4, when using the version 1
SSH protocol, allows remote attackers to cause a denial of service
(CPU consumption) via an SSH packet that contains duplicate blocks,
which is not properly handled by the CRC compensation attack detector.
NOTE: ESX by default disables version 1 SSH protocol.
(CVE-2006-5051) Signal handler race condition in OpenSSH before 4.4 allows
remote attackers to cause a denial of service (crash), and possibly
execute arbitrary code if GSSAPI authentication is enabled, via unspecified
vectors that lead to a double-free.
NOTE: ESX doesn't use GSSAPI by default.
(CVE-2006-5794) Unspecified vulnerability in the sshd Privilege Separation
Monitor in OpenSSH before 4.5 causes weaker verification that
authentication has been successful, which might allow attackers to bypass
authentication.
NOTE: as of 20061108, it is believed that this issue is only exploitable
by leveraging vulnerabilities in the unprivileged process, which are not
known to exist.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
assigned the names CVE-2004-2069, CVE-2006-0225, CVE-2003-0386,
CVE-2006-4924, CVE-2006-5051, and CVE-2006-5794 to these issues.
d. Object reuse problems with newly created virtual disk (.vmdk or .dsk) files:
ESX 3.0.1: does not have this problem
ESX 3.0.0: does not have this problem
ESX 2.5.4: corrected by ESX 2.5.4 Upgrade Patch 3 (Build# 36502)
ESX 2.5.3: corrected by ESX 2.5.3 Upgrade Patch 6 (Build# 35703)
ESX 2.1.3: corrected by ESX 2.1.3 Upgrade Patch 4 (Build# 35803)
ESX 2.0.2: corrected by ESX 2.0.2 Upgrade Patch 4 (Build# 35801)
A possible security issue with virtual disk (.vmdk or .dsk) files
that are newly created, but contain blocks from recently deleted
virtual disk files. Information belonging to the previously
deleted virtual disk files could be revealed in newly created
virtual disk files.
VMware recommends the following workaround: When creating new
virtual machines on an ESX Server that may contain sensitive
data, use vmkfstools with the -W option. This initializes the
virtual disk with zeros.
e. Buffer overflow in Python function repr():
ESX 3.0.1: corrected by Patch ESX-9986131
ESX 3.0.0: corrected by ESX-3069097
ESX 2.5.4: does not have this problem
ESX 2.5.3: does not have this problem
ESX 2.1.3: does not have this problem
ESX 2.0.2: does not have this problem
A possible security issue with how the Python function repr()
function handles UTF-32/UCS-4 strings. Python applications
using this function can open a security vulnerability that could
allow the execution of arbitrary code.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
assigned the name CVE-2006-4980 to this issue.
4. Solution:
Please review the Patch notes for your version of ESX and verify the md5sum.
ESX 3.0.1
www.vmware.com/support/vi3/doc/esx-9986131-patch.html
md5usm: 239375e107fd4c7af57663f023863fcb
ESX 3.0.0
www.vmware.com/support/vi3/doc/esx-3069097-patch.html
md5sum: ca9947239fffda708f2c94f519df33dc
ESX 2.5.4
www.vmware.com/support/esx25/doc/esx-254-200612-patch.html
md5sum: 239375e107fd4c7af57663f023863fcb
ESX 2.5.3
www.vmware.com/support/esx25/doc/esx-253-200612-patch.html
md5sum: f90fcab28362edbf2311f3ca90cc7739
ESX 2.1.3
www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
md5sum: 7d7d0e40f4dccd5ca64b9c13a856da8f
ESX 2.0.2
www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
md5sum: 925e70f28d17714c53fdbd24de64329f
5. References:
Patch URL:http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html
Patch URL:http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html
Patch URL:http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
Patch URL:http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
Patch URL:http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
Patch URL:http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
Knowledge base URL:http://kb.vmware.com/kb/3069097
Knowledge base URL:http://kb.vmware.com/kb/9986131
cve.mitre.org/cgi-bin/cvename.cgi
cve.mitre.org/cgi-bin/cvename.cgi
cve.mitre.org/cgi-bin/cvename.cgi
cve.mitre.org/cgi-bin/cvename.cgi
cve.mitre.org/cgi-bin/cvename.cgi
cve.mitre.org/cgi-bin/cvename.cgi
cve.mitre.org/cgi-bin/cvename.cgi
6. Contact:
VMware Security Response Policy
www.vmware.com/vmtn/technology/security/security_response.html
E-mail: security@vmware.com
Copyright 2007 VMware Inc. All rights reserved.