VMware Security Advisories
VMSA-2008-0006.1
Updated libxml2 service console package
VMware Security Advisory
1. Summary
Updated libxml2 package addresses a security issue.
2. Relevant releases
VMware ESX 3.5 without patch ESX350-200803214-UG
VMware ESX 3.0.2 without patch ESX-1003528
VMware ESX 3.0.1 without patch ESX-1003521
VMware ESX 2.5.5 before Upgrade Patch 6
VMware ESX 2.5.4 before Upgrade Patch 17
NOTE: ESX 3.0.1 is in Extended Support and its end of support (Security and Bug fixes) is 07/31/2008. Users should plan to upgrade to at least 3.0.2 update 1 and preferably the newest release available before the end of extended support.
NOTE: ESX 2.5.4 is in Extended Support and its end of support (Security and Bug fixes) is 10/08/2008. Users should plan to upgrade to at least 2.5.5 and preferably the newest release available before the end of extended support.
ESX Server versions 3.0.0 and prior to 2.5.4 are no longer in Extended Support. Users should upgrade to a supported version of the product.
The VMware Infrastructure Support Life Cycle Policy can be found here: www.vmware.com/support/policies/eos_vi.html
3. Problem description
Updated libxml2 package to address a denial of service flaw.
Thanks to the Google security team for identifying and reporting this issue.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-6284 to this issue.
4. Solution
Please review the Patch notes for your product and version and verify the md5sum of your downloaded file.
ESX 3.5 Patch ESX350-200803214-UG
download3.vmware.com/software/esx/ESX350-200803214-UG.zip
md5sum: 9ff7b416afed3acfbfbb5d1d63ca5060
kb.vmware.com/kb/1003721
VMware ESX 3.0.2 patch ESX-1003528
download3.vmware.com/software/vi/ESX-1003528.tgz
md5sum: 930b4a7b0084b6875e346007257e82aa
kb.vmware.com/kb/1003528
VMware ESX 3.0.1 patch ESX-1003521
download3.vmware.com/software/vi/ESX-1003521.tgz
md5sum: 54ac44402252128042c8325c4c1b63b2
kb.vmware.com/kb/1003521
ESX 2.5.5 Upgrade Patch 6
download3.vmware.com/software/esx/esx-2.5.5-78667-upgrade.tar.gz
md5sum: b4d5e98cc175a507e8f89d9c7b993e2c
vmware.com/support/esx25/doc/esx-255-200803-patch.html
ESX 2.5.4 Upgrade Patch 17
download3.vmware.com/software/esx/esx-2.5.4-78717-upgrade.tar.gz
md5sum: 827406844dacba92f695980f49119465
vmware.com/support/esx25/doc/esx-254-200803-patch.html
5. References
CVE numbers
cve.mitre.org/cgi-bin/cvename.cgi
6. Change log
2008-03-28 VMSA-2008-0006 Initial release
2008-04-11 VMSA-2008-0006.1 Added patch information for
ESX 3.0.1, ESX 3.0.2, ESX 3.5
for patch release on 2008-04-10
7. Contact
E-mail list for product security notifications and announcements:
lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
PGP key at: kb.vmware.com/kb/1055
Security web site
www.vmware.com/security
VMware security response policy
www.vmware.com/support/policies/security_response.html
General support life cycle policy
www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
www.vmware.com/support/policies/eos_vi.html