-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2006-0008 Synopsis: VMware ESX Server 2.0.2 Upgrade Patch 2 Patch URL: http://www.vmware.com/download/esx/esx-202-200610-patch.html Issue date: 2006-10-31 Updated on: 2006-11-13 CVE Names: CAN-2004-2069 CVE-2006-3403 CVE-2005-2177 CVE-2006-3467 CVE-2006-1342 CVE-2006-1343 CVE-2006-1864 CVE-2006-2071 - ------------------------------------------------------------------- 1. Summary: Updated package addresses several security issues. 2. Relevant releases: VMware ESX 2.0.2 prior to upgrade patch 2 3. Problem description: This patch addresses the following security issues: Openssh -- A bug was found in the way the OpenSSH server handled the MaxStartups and LoginGraceTime configuration variables. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CAN-2004-2069 to this issue. samba -- A denial of service bug was found in the way the smbd daemon tracks active connections to shares. It was possible for a remote attacker to cause the smbd daemon to consume a large amount of system memory by sending carefully crafted smb requests. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-3403 to this issue. Python -- An integer overflow flaw was found in Python's PCRE library that could be triggered by a maliciously crafted regular expression. On systems that accept arbitrary regular expressions from untrusted users, this could be exploited to execute arbitrary code with the privileges of the application using the library. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-2491 to this issue. ucd-snmp -- A denial of service bug was found in the way ucd-snmp uses network stream protocols. A remote attacker could send a ucd-snmp agent a specially crafted packet which will cause the agent to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CAN-2005-2177 to this issue. XFree86 -- An integer overflow flaw in the way the XFree86 server processes PCF font files was discovered. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the XFree86 server. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-3467 to this issue. A minor info leak in socket name handling in the network code (CVE-2006-1342). A minor info leak in socket option handling in the network code (CVE-2006-1343). A directory traversal vulnerability in smbfs that allowed a local user to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences (CVE-2006-1864). A flaw in the mprotect system call that allowed to give write permission to a readonly attachment of shared memory (CVE-2006-2071). NOTE: AMD processers were not supported in the VMware ESX 2.0.2 release so CVE-2006-1056 is not applicable to this version of the product. The non-security-related fixes are documented on the patch download page. 4. Solution: Upgrade to the latest update package for your release of ESX. http://www.vmware.com/download/esx/ http://www.vmware.com/download/esx/esx-202-200610-patch.html he md5 checksum output should match the following: 9e79d333ac9360122fb69bc8fc549405 esx-2.0.2-31924-upgrade.tar.gz 5. References: http://www.vmware.com/download/esx/esx-202-200610-patch.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-2069 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3403 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2177 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3467 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1342 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1343 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1864 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2071 http://www.vmware.com/products/esx/ http://www.vmware.com/download/esx/ 6. Contact: http://www.vmware.com/security VMware Security Response Policy http://www.vmware.com/vmtn/technology/security/security_response.html E-mail: security@vmware.com - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.5 (GNU/Linux) mQGiBETOvBsRBACgKExi0wcncPksfT/c/HpYo8Sesdu8lujOlscso83UQplhFfR9 4wbYUdxpLOmCSmG2jz/Pd7gLADXbZUbF8pU6cKouU3/J7h2y3+uRv5pWUkCtzoxJ t5JWJix85efWaNvvz4dsk1jWirJebE1lTNmfBB0Oj2AFlo3WlkWcsL52UwCgxyzX nZCOejYzdYtgaZKEAr6OvaUD+gPyg0yDlhAMD6taCPLq+ZlMvpEnG5iFGhlY0CT9 UCyKbZUbPUQ2iknJwctcZWeFcxayeKDMa8QG8JdP3drmIaMWAYO40lKLC+2u0Bwm hlZG6fmJktqCtQ/ELm7C+aL2fAma1bPOSieUPAIVv32kBErE+FtWEWrByrI7M9aB bWQlA/4qbPDaKdWrg6wDWg0mLEs2MxnzXplngsYbjIrEjVVyJd71qHxn1MhdoskA Q58MLNK5XOI9yFyZBnKoAKyhTe+zM6Pk2Sv7XoCuo+D1P4GTWNSy+AFrsMiUGM60 XW+3QpBXTeymbRVzlIG9Ve9rRLNtz7Pjhe0q5qr0MAUMAOka4rRXVk13YXJlLCBJ bmMuIC0tIFNlY3VyaXR5IEFsZXJ0IChSZXBsYWNlcyAweEZCNDZENzkzKSA8dm13 YXJlLXNlY3VyaXR5LWFsZXJ0QHZtd2FyZS5jb20+iGYEExECACYFAkTOvBsCGyMF CQG4lNYGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAKCRDoqNCHLak+aXjOAJ9RqJqi gwQ78x++Ls6h+7aMEPdKGQCfZOlxHsxuNt0YiG0FuQhbRVUU8DCIRgQQEQIABgUC RM6+qwAKCRAuxkut+0bXkxtxAJ9JtI2KU9DMnigAEcqJNHmTc/3YqgCgwVNki2Vy I0b02VSgW9WmalSS8X65Ag0ERM68JhAIAIM+EzWb/xesC6PS2hz+2bLSDn8dEIyz B0hYSfctm+fNtU4n5lfLvAPdoPKOqDQfvJSk5SG6ImGppcTfubCFcyshbNcruj1b F702dTmqBVfmKlUFv9PUQNm6ZVSM6kNoFhuUwXayZ2P8x4u2WepZmRXPIWLnd/Hr AWRZOGYJ0RKG9UV74+Yx1xBYUIjYooKUJbXEY4ry0pTUeSpPcOhTm4jTsVaghsCf 2hM2tCRh0TmmVL6qUTsPbIYPdqDacjHkmG7d9/+vM580GlYLycTKppTs1zBItL9Z gXxl/3XQvSxrwYuy/N+a5k86bSoitl6hdH2ZoGXbgUH53Y8n1nOhY78AAwUH/2UH NlHFhZcdPtO1lGeWmN7tPO7jCD0Yb5wpE+gs35f3Sb4QXvkjd1DpZ0e5oHYLl68g LDh1PNMTruSq4F0ke3XdfZPXVjN+R5OjRssmvwcT3U+LeB1KUfWmGCZxXiXOPbLY s9MwoLuPi3guFNuBtcPBS86CPyN3HBfwBC+XahO98guhoAOFKysF/GVeyyrrPmgW GcNV9A8uWkPjNB9pOFK4XzFc/4FGUvpJ+cDTauGCyNpvStgErm2WAHrGpiKJyi4R u6SWJ+A7bA85+cjlToqSMG8jALQrzKKfpTERZsCSxq0hdAB771ND41opNTEw2z+N h7s6+G171oBWtpKolCqITwQYEQIADwUCRM68JgIbDAUJAbiU1gAKCRDoqNCHLak+ aWTeAKCJxLYg7oqyc2ZIgO5eM+wSdzzGWwCgoG9SvQ+SnBAbuSTeyoqiB95hCOA= =Ghmi - - -----END PGP PUBLIC KEY BLOCK----- - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFR+7s6KjQhy2pPmkRArtXAJ4wYbdDwhTJsS9USsjD1RuPoAnRTwCeNnsB 4458eYmwDtxPxWK6NQi/Ly4= =ZYZA - -----END PGP SIGNATURE----- Copyright 2006 VMware Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFWNeh6KjQhy2pPmkRAjKcAKCykND2NTxakcYqOVmzG/+XSPRwMACcCwDn Idovy9+26b/FufldanMBwmI= =soT2 -----END PGP SIGNATURE-----