Sign up for Security
Advisories

Enter your email address:


VMSA-2010-0020.1

VMware ESXi 4.1 Update Installer SFCB Authentication Flaw

VMware Security Advisory
Advisory ID: VMSA-2010-0020.1
Synopsis: VMware ESXi 4.1 Update Installer SFCB Authentication Flaw
Issue date: 2010-12-21
Updated on: 2012-02-10
CVE numbers: CVE-2010-4573
1. Summary

VMware ESXi 4.1 Update Installer might introduce a SFCB Authentication Flaw.
2. Relevant releases

VMware ESXi 4.1 if upgraded from ESXi 3.5 or ESXi 4.0 with a modified SFCB configuration file, without patch ESXi410-201101201-SG.
3. Problem Description
a. ESXi 4.1 Update Installer SFCB Authentication Flaw

Under certain conditions, the ESXi 4.1 installer that upgrades an ESXi 3.5 or ESXi 4.0 host to ESXi 4.1 incorrectly handles the SFCB authentication mode. The result is that SFCB authentication could allow login with any username and password combination.

An ESXi 4.1 host is affected if all of the following apply:
- ESXi 4.1 was upgraded from ESXi 3.5 or ESXi 4.0.
- The SFCB configuration file /etc/sfcb/sfcb.cfg was modified prior to the upgrade.
- The sfcbd daemon is running (sfcbd runs by default).

Workaround
A workaround that can be applied to ESXi 4.1 is described in VMware Knowledge Base Article KB 1031761

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-4573 to this issue.

Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware
Product
Product
Version
Running
On
Replace with
Apply Path
============= ======== ======= =================
VirtualCenter any Windows not affected
hosted * any any not affected
ESXi 4.1 ESXi ESXi410-201101201-SG
ESXi 4.0 ESXi not affected
ESX 3.5 ESXi not affected
ESX any ESX not affected


* hosted products are VMware Workstation, Player, ACE, Server, Fusion.
4. Solution

Please review the patch/release notes for your product and version and verify the md5sum of your downloaded file.

ESXi 4.1 Installable Update 1
-----------------------------
ESX350-201002401-SG
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vsphere_4/4_0
Release Notes:
http://downloads.vmware.com/support/vsphere4/doc/vsp_esx41_u1_rel_notes.html

http://kb.vmware.com/kb/1027919

File type: .iso
MD5SUM: d68d6c2e040a87cd04cd18c04c22c998
SHA1SUM: bbaacc0d34503822c14f6ccfefb6a5b62d18ae64
ESXi 4.1 Update 1 (upgrade ZIP from ESXi 4.1)

File type: .zip
MD5SUM: 2f1e009c046b20042fae3b7ca42a840f
SHA1SUM: 1c9c644012dec657a705ddd3d033cbfb87a1fab1
ESXi 4.1 Update 1 (upgrade ZIP from ESXi 4.0)

File type: .zip
MD5SUM: 67b924618d196dafaf268a7691bd1a0f
SHA1SUM: 9d74b639e703259d9e49c0341158e0d4e45de516
ESXi 4.1 Update 1 (upgrade ZIP from ESXi 3.5)

File type: .zip
MD5SUM: a6024b9f6c6b7b2c629696afc6d07cf4
SHA1SUM: b3841de1a30617ac68d5a861882aa72de3a93488
VMware Tools CD image for Linux Guest OSes

File type: .iso
MD5SUM: dad66fa8ece1dd121c302f45444daa70
SHA1SUM: 56535a2cfa7799607356c6fd0a7d9f041da614af
VMware vSphere Client

File type: .exe
MD5SUM: cb6aa91ada1289575355d79e8c2a9f8e
SHA1SUM: f9e3d8eb83196ae7c31aab554e344a46b722b1e4
ESXi Installable Update 1 contains the following security bulletins:
ESXi410-201101201-SG.
6. Change log

2010-12-21 VMSA-2010-0020
Initial security advisory after release of VMware knowledge base article
that documents workaround on 2010-12-21.
2011-02-10 VMSA-2010-0020.1
Updated security advisory in conjunction with the release of patches
for ESXi 4.1 as part of the ESXi 4.1 Update 1 release on 2011-02-10.
7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

  • security-announce at lists.vmware.com
  • bugtraq at securityfocus.com
  • full-disclosure at lists.grok.org.uk

E-mail: security at vmware.com
PGP key at:
http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security/advisories

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2010 VMware Inc. All rights reserved.