-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


- -------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2006-0005
Synopsis:          VMware ESX Server 2.5.4 Upgrade Patch 1 
Patch URL: http://www.vmware.com/download/esx/esx-254-200610-patch.html
Issue date:        2006-10-31
Updated on:        2006-11-13
CVE Names:         CVE-2005-2177 CVE-2006-3467 CVE-2006-1056 
                   CVE-2006-1342 CVE-2006-1343 CVE-2006-1864
                   CVE-2006-2071
- -------------------------------------------------------------------

1. Summary:

Updated package addresses several security issues.

2. Relevant releases:

VMware ESX 2.5.4 prior to upgrade patch 1

3. Problem description:

This patch addresses the following security issues:

ucd-snmp -- A denial of service bug was found in the way ucd-snmp uses network
stream protocols. A remote attacker could send a ucd-snmp agent a specially
crafted packet which will cause the agent to crash. The Common Vulnerabilities
and Exposures project (cve.mitre.org) assigned the name CAN-2005-2177 to this
issue.

XFree86 -- An integer overflow flaw in the way the XFree86 server processes
PCF font files was discovered. A malicious authorized client could exploit this
issue to cause a denial of service (crash) or potentially execute arbitrary
code with root privileges on the XFree86 server. The Common Vulnerabilities
and Exposures project (cve.mitre.org) assigned the name CVE-2006-3467 to
this issue.

An AMD fxsave/restore security vulnerability. The instructions fxsave
and fxrstor on AMD CPUs are used to save or restore the FPU registers
(FOP, FIP and FDP). On AMD Opteron processors, these instructions do not
save/restore some exception related registers unless an exception is
currently being serviced. This could allow a local attacker to partially 
monitor the execution path of FPU processes, possibly allowing them to 
obtain sensitive information being passed through those processes.  The 
Common Vulnerabilities and Exposures project (cve.mitre.org) assigned 
the name CVE-2006-1056 to this issue.

A minor info leak in socket name handling in the network code (CVE-2006-1342).
A minor info leak in socket option handling in the network code (CVE-2006-1343).
A directory traversal vulnerability in smbfs that allowed a local user to 
escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences (CVE-2006-1864).
A flaw in the mprotect system call that allowed to give write permission to a readonly attachment of shared memory (CVE-2006-2071).

The non-security-related fixes are documented on the patch download page.

4. Solution:

Upgrade to the latest update package for your release of ESX. 
http://www.vmware.com/download/esx/

http://www.vmware.com/download/esx/esx-254-200610-patch.html

The md5 checksum output should match the following:
6bc66a5cdbfea08f762f375f2488998b esx-2.5.4-32461-upgrade.tar.gz

5. References:
http://www.vmware.com/download/esx/esx-254-200610-patch.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2177 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3467 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1056
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1342 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1343 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2071
http://www.vmware.com/products/esx/
http://www.vmware.com/download/esx/

6. Contact:

http://www.vmware.com/security

VMware Security Response Policy
http://www.vmware.com/vmtn/technology/security/security_response.html

E-mail:  security@vmware.com

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.5 (GNU/Linux)

mQGiBETOvBsRBACgKExi0wcncPksfT/c/HpYo8Sesdu8lujOlscso83UQplhFfR9
4wbYUdxpLOmCSmG2jz/Pd7gLADXbZUbF8pU6cKouU3/J7h2y3+uRv5pWUkCtzoxJ
t5JWJix85efWaNvvz4dsk1jWirJebE1lTNmfBB0Oj2AFlo3WlkWcsL52UwCgxyzX
nZCOejYzdYtgaZKEAr6OvaUD+gPyg0yDlhAMD6taCPLq+ZlMvpEnG5iFGhlY0CT9
UCyKbZUbPUQ2iknJwctcZWeFcxayeKDMa8QG8JdP3drmIaMWAYO40lKLC+2u0Bwm
hlZG6fmJktqCtQ/ELm7C+aL2fAma1bPOSieUPAIVv32kBErE+FtWEWrByrI7M9aB
bWQlA/4qbPDaKdWrg6wDWg0mLEs2MxnzXplngsYbjIrEjVVyJd71qHxn1MhdoskA
Q58MLNK5XOI9yFyZBnKoAKyhTe+zM6Pk2Sv7XoCuo+D1P4GTWNSy+AFrsMiUGM60
XW+3QpBXTeymbRVzlIG9Ve9rRLNtz7Pjhe0q5qr0MAUMAOka4rRXVk13YXJlLCBJ
bmMuIC0tIFNlY3VyaXR5IEFsZXJ0IChSZXBsYWNlcyAweEZCNDZENzkzKSA8dm13
YXJlLXNlY3VyaXR5LWFsZXJ0QHZtd2FyZS5jb20+iGYEExECACYFAkTOvBsCGyMF
CQG4lNYGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAKCRDoqNCHLak+aXjOAJ9RqJqi
gwQ78x++Ls6h+7aMEPdKGQCfZOlxHsxuNt0YiG0FuQhbRVUU8DCIRgQQEQIABgUC
RM6+qwAKCRAuxkut+0bXkxtxAJ9JtI2KU9DMnigAEcqJNHmTc/3YqgCgwVNki2Vy
I0b02VSgW9WmalSS8X65Ag0ERM68JhAIAIM+EzWb/xesC6PS2hz+2bLSDn8dEIyz
B0hYSfctm+fNtU4n5lfLvAPdoPKOqDQfvJSk5SG6ImGppcTfubCFcyshbNcruj1b
F702dTmqBVfmKlUFv9PUQNm6ZVSM6kNoFhuUwXayZ2P8x4u2WepZmRXPIWLnd/Hr
AWRZOGYJ0RKG9UV74+Yx1xBYUIjYooKUJbXEY4ry0pTUeSpPcOhTm4jTsVaghsCf
2hM2tCRh0TmmVL6qUTsPbIYPdqDacjHkmG7d9/+vM580GlYLycTKppTs1zBItL9Z
gXxl/3XQvSxrwYuy/N+a5k86bSoitl6hdH2ZoGXbgUH53Y8n1nOhY78AAwUH/2UH
NlHFhZcdPtO1lGeWmN7tPO7jCD0Yb5wpE+gs35f3Sb4QXvkjd1DpZ0e5oHYLl68g
LDh1PNMTruSq4F0ke3XdfZPXVjN+R5OjRssmvwcT3U+LeB1KUfWmGCZxXiXOPbLY
s9MwoLuPi3guFNuBtcPBS86CPyN3HBfwBC+XahO98guhoAOFKysF/GVeyyrrPmgW
GcNV9A8uWkPjNB9pOFK4XzFc/4FGUvpJ+cDTauGCyNpvStgErm2WAHrGpiKJyi4R
u6SWJ+A7bA85+cjlToqSMG8jALQrzKKfpTERZsCSxq0hdAB771ND41opNTEw2z+N
h7s6+G171oBWtpKolCqITwQYEQIADwUCRM68JgIbDAUJAbiU1gAKCRDoqNCHLak+
aWTeAKCJxLYg7oqyc2ZIgO5eM+wSdzzGWwCgoG9SvQ+SnBAbuSTeyoqiB95hCOA=
=Ghmi
- - -----END PGP PUBLIC KEY BLOCK-----
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFR+7s6KjQhy2pPmkRArtXAJ4wYbdDwhTJsS9USsjD1RuPoAnRTwCeNnsB
4458eYmwDtxPxWK6NQi/Ly4=
=ZYZA
- -----END PGP SIGNATURE-----

Copyright 2006 VMware Inc. All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFWNeb6KjQhy2pPmkRAubKAJ0cKVcNWNR5zlc6Ld0JmLpF7lmD3wCdF/n2
jI/ThCpP+46ySqYGR62rbAk=
=zUGx
-----END PGP SIGNATURE-----