VMSA-2010-0020.1
VMware ESXi 4.1 Update Installer SFCB Authentication Flaw
VMware Security Advisory
1. Summary
VMware ESXi 4.1 Update Installer might introduce a SFCB Authentication Flaw.
2. Relevant releases
VMware ESXi 4.1 if upgraded from ESXi 3.5 or ESXi 4.0 with a modified SFCB configuration file, without patch ESXi410-201101201-SG.
3. Problem Description
a. ESXi 4.1 Update Installer SFCB Authentication Flaw
Under certain conditions, the ESXi 4.1 installer that upgrades an ESXi 3.5 or ESXi 4.0 host to ESXi 4.1 incorrectly handles the SFCB authentication mode. The result is that SFCB authentication could allow login with any username and password combination.
An ESXi 4.1 host is affected if all of the following apply:
- ESXi 4.1 was upgraded from ESXi 3.5 or ESXi 4.0.
- The SFCB configuration file /etc/sfcb/sfcb.cfg was modified prior to the upgrade.
- The sfcbd daemon is running (sfcbd runs by default).
Workaround
A workaround that can be applied to ESXi 4.1 is described in VMware Knowledge Base Article KB 1031761
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-4573 to this issue.
Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
VMware Product =============
Product Version ========
Running On =======
Replace with Apply Path =================
* hosted products are VMware Workstation, Player, ACE, Server, Fusion.
4. Solution
Please review the patch/release notes for your product and version and verify the md5sum of your downloaded file.
ESXi 4.1 Installable Update 1
-----------------------------
ESX350-201002401-SG
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vsphere_4/4_0
Release Notes:
http://downloads.vmware.com/support/vsphere4/doc/vsp_esx41_u1_rel_notes.html
http://kb.vmware.com/kb/1027919
File type: .iso
MD5SUM: d68d6c2e040a87cd04cd18c04c22c998
SHA1SUM: bbaacc0d34503822c14f6ccfefb6a5b62d18ae64
ESXi 4.1 Update 1 (upgrade ZIP from ESXi 4.1)
File type: .zip
MD5SUM: 2f1e009c046b20042fae3b7ca42a840f
SHA1SUM: 1c9c644012dec657a705ddd3d033cbfb87a1fab1
ESXi 4.1 Update 1 (upgrade ZIP from ESXi 4.0)
File type: .zip
MD5SUM: 67b924618d196dafaf268a7691bd1a0f
SHA1SUM: 9d74b639e703259d9e49c0341158e0d4e45de516
ESXi 4.1 Update 1 (upgrade ZIP from ESXi 3.5)
File type: .zip
MD5SUM: a6024b9f6c6b7b2c629696afc6d07cf4
SHA1SUM: b3841de1a30617ac68d5a861882aa72de3a93488
VMware Tools CD image for Linux Guest OSes
File type: .iso
MD5SUM: dad66fa8ece1dd121c302f45444daa70
SHA1SUM: 56535a2cfa7799607356c6fd0a7d9f041da614af
VMware vSphere Client
File type: .exe
MD5SUM: cb6aa91ada1289575355d79e8c2a9f8e
SHA1SUM: f9e3d8eb83196ae7c31aab554e344a46b722b1e4
ESXi Installable Update 1 contains the following security bulletins:
ESXi410-201101201-SG.
6. Change log
2010-12-21 VMSA-2010-0020
Initial security advisory after release of VMware knowledge base article
that documents workaround on 2010-12-21.
2011-02-10 VMSA-2010-0020.1
Updated security advisory in conjunction with the release of patches
for ESXi 4.1 as part of the ESXi 4.1 Update 1 release on 2011-02-10.
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
- security-announce at lists.vmware.com
- bugtraq at securityfocus.com
- full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at:
http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.