Izdana je revizija upozorenja oznake VMSA-2012-0012 prvotno objavljenog 12. srpnja 2012. godine. Originalna preporuka upozoravala je na brojne propuste otkrivene u radu programske biblioteke libxml2 koje udaljeni napadač može iskoristiti za izvođenje DoS napada ili pokretanje proizvoljnog programskog koda.
Propusti su posljedica cjelobrojnog prepisivanja u datoteci xpath.c, preljeva međuspremnika te višestrukih "double free" ranjivosti. Revizija je izdana zbog dodavanja informacija vezanih uz zakrpu za ESXi.
Posljedica:
Navedene propuste moguće je iskoristiti za izvođenje napada uskraćivanjem usluge (eng. DoS attack) ili izvršavanje proizvoljnog programskog koda.
Rješenje:
Kako bi se zaštitili, korisnicima se savjetuje korištenje odgovarajuće programske nadogradnje.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
-----------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2012-0012.1
Synopsis: VMware ESXi update to third party library
Issue date: 2012-07-12
Updated on: 2012-08-30
CVE number: CVE-2010-4008, CVE-2010-4494, CVE-2011-0216,
CVE-2011-1944, CVE-2011-2821, CVE-2011-2834,
CVE-2011-3905, CVE-2011-3919, CVE-2012-0841
-----------------------------------------------------------------------
1. Summary
VMware ESXi update addresses several security issues.
2. Relevant releases
ESXi 5.0 without patch ESXi500-201207101-SG
ESXi 4.1 without patch ESXi410-201208101-SG
3. Problem Description
a. ESXi update to third party component libxml2
The libxml2 third party library has been updated which addresses
multiple security issues
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2010-4008, CVE-2010-4494, CVE-2011-0216,
CVE-2011-1944, CVE-2011-2821, CVE-2011-2834, CVE-2011-3905,
CVE-2011-3919 and CVE-2012-0841 to these issues.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
========== ======== ======== =================
vCenter any Windows not affected
hosted * any any not affected
ESXi 5.0 any ESXi500-201207101-SG
ESXi 4.1 any ESXi410-201208101-SG
ESXi 4.0 any patch pending
ESXi 3.5 any patch pending
ESX any any not applicable
* hosted products are VMware Workstation, Player, ACE, Fusion.
Note: "patch pending" means that the product is affected, but no
patch is currently available. The advisory will be updated
when a patch is available.
4. Solution
Please review the patch/release notes for your product and
version and verify the checksum of your downloaded file.
ESXi
----
http://downloads.vmware.com/go/selfsupport-download
ESXi 5.0
--------
Patch: ESXi500-201207001
md5sum: 01196c5c1635756ff177c262cb69a848
sha1sum: 85936f5439100cd5fb55c7add574b5b3b937fe86
http://kb.vmware.com/kb/2020571
ESXi500-201207001 contains ESXi500-201207101-SG
ESXi 4.1
--------
File: update-from-esxi4.1-4.1_update03.zip
md5sum: b35267e3c96a8ebd2e3acac09538cdf5
sha1sum: 2b2d456e89964528f25c01ae5d84edbd2bbcdefb
http://kb.vmware.com/kb/2020373
update-from-esxi4.1-4.1_update03 contains ESXi410-201208101-SG
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4008
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1944
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2821
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2834
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3905
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0841
-----------------------------------------------------------------------
6. Change log
2012-07-12 VMSA-2012-0012
Initial security advisory in conjunction with the release of a patch
for ESXi 5.0 on 2012-07-12.
2012-08-30 VMSA-2012-0012.1
Updated Relevant Releases, Problem Description, and Solution
sections to include information regarding updates for ESXi in
conjuction with the release of vSphere 4.1 U3 on 2012-08-30.
-----------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2012 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8
wj8DBQFQQF0CDEcm8Vbi9kMRAteSAJ4tg2GVu/DeVllZ6m7gN+2PqJhHJwCg643p
Lssh03wUlmZszcPwhyT+HCc=
=YLTm
-----END PGP SIGNATURE-----
_______________________________________________
Security-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
http://lists.vmware.com/mailman/listinfo/security-announce
Posljednje sigurnosne preporuke