VMware advisories/updates

FYI…

VMSA-2009-0015 - VMware Security Advisory
- http://lists.vmware.com/pipermail/security…009/000069.html
2009-10-27
CVE numbers: CVE-2009-2267, CVE-2009-3733…
Initial security advisory after release of Server 1.0.10, Server 2.0.2 and Upgrade Patch 15 for ESX 2.5.5 on 2009-10-27. The versions of Workstation, Player, ACE, Fusion, and patches for ESXi 4.0, ESXi 3.5, ESX 4.0, ESX 3.5, ESX 3.0.3 mentioned above have already been released…"

- http://www.vmware.com/security/advisories/…-2009-0015.html

FYI…

VMware Security Advisory - VMSA-2009-0016
- http://www.vmware.com/security/advisories/…-2009-0016.html
Nov 20, 2009 - "… Updated Java JRE packages and Tomcat packages address several security issues. Updates for the ESX Service Console and vMA include kernel, ntp, Python, bind libxml, libxml2, curl and gnutil packages. ntp is also updated for ESXi userworlds…"

- http://secunia.com/advisories/37470/2/

- http://secunia.com/advisories/37471/2/

- http://secunia.com/advisories/37460/2/

FYI..

VMSA-2009-0017 - Security Advisory
- http://www.vmware.com/security/advisories/…-2009-0017.html
Synopsis: VMware vCenter, ESX patch and vCenter Lab Manager releases address cross-site scripting issues
Issue date: 2009-12-15
CVE numbers: CVE-2009-3731 …
Summary:
VMware vCenter and ESX update releases address cross-site scripting issues in the Help functionality of WebAccess. A vCenter Lab Manager release addresses the same issues which are present in the online Help functionality of Lab Manager and Stage Manager…"

FYI…

VMSA-2010-0001 - ESX Service Console updates…
- http://secunia.com/advisories/38091/2/
Release Date: 2010-01-07
Critical: Highly critical
Impact: Security Bypass, Manipulation of data, DoS, System access
Where: From remote
Solution Status: Partial Fix
OS: VMware ESX Server 4.x
Software: VMware vMA 4.x…
Solution:
VMware ESX 4.0: Apply ESX400-200912403-SG.
VMware vMA (on RHEL5) 4.0: A patch is still pending.
Original Advisory: VMSA-2010-0001:
http://lists.vmware.com/pipermail/security…010/000075.html …

- http://www.vmware.com/security/advisories/…-2010-0001.html

- http://secunia.com/advisories/38091/3/
CVE reference: CVE-2009-1563, CVE-2009-2404, CVE-2009-2408, CVE-2009-2409, CVE-2009-3274, CVE-2009-3370, CVE-2009-3372, CVE-2009-3373, CVE-2009-3374, CVE-2009-3375, CVE-2009-3376, CVE-2009-3380, CVE-2009-3382
___

- http://www.us-cert.gov/current/#vmware_rel…urity_advisory3
"… Additionally, VMware has updated two previously released advisories: VMSA-2009-0014.2 that addresses vulnerabilities in the DHCP, Service Console Kernel, and Java JRE packages for ESX, and VMSA-2009-0004.3 that addresses vulnerabilities in the OpenSSL, BIND, and Vim packages for ESX.
… review VMware Security Advisory… VMSA-2009-0014.2*, and VMSA-2009-0004.3** and apply any necessary updates to help mitigate the risks.
* http://lists.vmware.com/pipermail/security…010/000076.html
** http://lists.vmware.com/pipermail/security…010/000077.html

FYI…

New and updated VMWare advisories
- http://isc.sans.org/diary.html?storyid=8122
Last Updated: 2010-01-30 11:04:17 UTC - "Today VMware has released the following new and updated security advisories:
New - VMSA-2010-0002:
- http://lists.vmware.com/pipermail/security…010/000078.html
This is described as - VMware vCenter update release addresses multiple security issues in Java JRE. The JRE is updated to version 1.5.0_22 and this covers a *lot* of CVE's.
CVE numbers: — JRE —
CVE-2009-1093 CVE-2009-1094 CVE-2009-1095 CVE-2009-1096 CVE-2009-1097 CVE-2009-1098
CVE-2009-1099 CVE-2009-1100 CVE-2009-1101 CVE-2009-1102 CVE-2009-1103 CVE-2009-1104
CVE-2009-1105 CVE-2009-1106 CVE-2009-1107 CVE-2009-2625 CVE-2009-2670 CVE-2009-2671
CVE-2009-2672 CVE-2009-2673 CVE-2009-2675 CVE-2009-2676 CVE-2009-2716 CVE-2009-2718
CVE-2009-2719 CVE-2009-2720 CVE-2009-2721 CVE-2009-2722 CVE-2009-2723 CVE-2009-2724
CVE-2009-3728 CVE-2009-3729 CVE-2009-3864 CVE-2009-3865 CVE-2009-3866 CVE-2009-3867
CVE-2009-3868 CVE-2009-3869 CVE-2009-3871 CVE-2009-3872 CVE-2009-3873 CVE-2009-3874
CVE-2009-3875 CVE-2009-3876 CVE-2009-3877 CVE-2009-3879 CVE-2009-3880 CVE-2009-3881
CVE-2009-3882 CVE-2009-3883 CVE-2009-3884 CVE-2009-3886 CVE-2009-3885

Updated - VMSA-2009-0016.2:
- http://lists.vmware.com/pipermail/security…010/000079.html "

> http://www.vmware.com/security/advisories/…-2010-0002.html

- http://secunia.com/advisories/38384/2/
Release Date: 2010-02-01
Critical: Highly critical
Impact: Security Bypass, Exposure of sensitive information, DoS, System access
Where: From remote
Software: VMware VirtualCenter 2.x
Solution: VMware VirtualCenter 2.5: Update to version 2.5 update 6.
VMware VirtualCenter 2.0.2: A patch is pending.
Original Advisory: VMSA-2010-0002:
http://lists.vmware.com/pipermail/security…010/000078.html

- http://secunia.com/advisories/38438/2/
Release Date: 2010-02-01
Critical: Highly critical
Impact: Security Bypass, Exposure of sensitive information, DoS, System access
Where: From remote
OS: VMware ESX Server 3.x, VMware ESX Server 4.x
Original Advisory: VMSA-2010-0002:
http://lists.vmware.com/pipermail/security…010/000078.html

FYI…

VMSA-2010-0003 - VMware ESX Server update
- http://secunia.com/advisories/38562/
Release Date: 2010-02-17
Impact: DoS
Where: From local network
Solution Status: Vendor Patch
Operating System: VMware ESX Server 3.x
Original Advisory: VMSA-2010-0003:
http://lists.vmware.com/pipermail/security…010/000080.html

- http://www.vmware.com/security/advisories/…-2010-0003.html

Multiple Security Updates for ESX 3.x and ESXi 3.x
- http://isc.sans.org/diary.html?storyid=8254
Last Updated: 2010-02-17 14:26:08 UTC

FYI…

VMSA-2010-0004 - VMware ESX Servers…

- http://www.vmware.com/security/advisories/…-2010-0004.html

- http://secunia.com/advisories/38833/
Release Date: 2010-03-04
Criticality level: Moderately critical
Impact: Security Bypass, DoS, System access
Where: From remote
Solution Status: Vendor Patch
Operating System: VMware ESX Server 4.x
Solution: Apply ESX400-201002404-SG, ESX400-201002407-SG, and ESX400-201002406-SG:
Original Advisory: VMSA-2010-0004:
http://lists.vmware.com/pipermail/security…010/000082.html

- http://secunia.com/advisories/38794/
Release Date: 2010-03-04
Criticality level: Moderately critical
Impact: Security Bypass, Spoofing, Exposure of sensitive information, Privilege escalation, DoS, System access
Where: From remote
Solution Status: Vendor Patch
Software: VMware vMA 4.x
Solution: Apply vMA 4.0 Patch 3.
Original Advisory: VMSA-2010-0004:
http://lists.vmware.com/pipermail/security…010/000082.html

- http://secunia.com/advisories/38834/
Release Date: 2010-03-04
Criticality level: Less critical
Impact: Spoofing, Exposure of sensitive information, Privilege escalation, DoS
Where: From local network
Solution Status: Unpatched
Operating System: VMware ESX Server 4.x
Original Advisory: VMSA-2010-0004:
http://lists.vmware.com/pipermail/security…010/000082.html
Mar 3, 2010 - "… table lists what action remediates the vulnerability…"

- http://secunia.com/advisories/38832/
Release Date: 2010-03-04
Criticality level: Less critical
Impact: DoS
Where: From local network
Solution Status: Unpatched
Operating System: VMware ESX Server 2.x, VMware ESX Server 3.x
Solution: Restrict network access to trusted users only.
Original Advisory: VMSA-2010-0004:
http://lists.vmware.com/pipermail/security…010/000082.html

- http://lists.vmware.com/pipermail/security…10/subject.html

FYI…

VMware updates…
- http://lists.vmware.com/pipermail/security…date.html#start
Mar 8, 2010
UPDATED VMSA-2010-0003.1 ESX Service Console update for net-snmp…
UPDATED VMSA-2010-0001.1 ESX Service Console and vMA updates for nss and nspr
UPDATED VMSA-2009-0016.4 VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components

FYI…

VMSA-2010-0005 VMware
- http://www.vmware.com/security/advisories/…-2010-0005.html

- http://lists.vmware.com/pipermail/security…010/000086.html
Synopsis: VMware products address vulnerabilities in WebAccess
Updated on: 2010-03-29 (initial release of advisory)
CVE numbers: CVE-2009-2277, CVE-2010-1137, CVE-2010-0686, CVE-2010-1193

- http://isc.sans.org/diary.html?storyid=8536
Last Updated: 2010-03-30 06:11:33 UTC
VMSA-2010-0005
http://lists.vmware.com/pipermail/security…010/000086.html
Updated - VMSA-2009-0016.5
http://lists.vmware.com/pipermail/security…010/000087.html
Update - VMSA-2010-0002.1
http://lists.vmware.com/pipermail/security…010/000088.html

- http://lists.vmware.com/pipermail/security…date.html#start

- http://secunia.com/advisories/39189/

- http://secunia.com/advisories/39197/

- http://secunia.com/advisories/39172/

- http://secunia.com/advisories/39171/

FYI…

VMSA-2010-0006 ESX Service Console updates for samba and acpid

- http://www.vmware.com/security/advisories/…-2010-0006.html

- http://lists.vmware.com/pipermail/security…010/000089.html
Apr 1 12:28:43 PDT 2010

Synopsis: ESX Service Console updates for samba and acpid
CVE numbers: CVE-2009-2906, CVE-2009-1888, CVE-2009-2813, CVE-2009-2948, CVE-2009-0798

- http://secunia.com/advisories/39147/
- http://secunia.com/advisories/39162/
- http://secunia.com/advisories/39218/

FYI…

VMSA-2010-0007.1
VMware hosted products, vCenter Server and ESX patches resolve multiple security issues
- http://www.vmware.com/security/advisories/…-2010-0007.html
Updated on: 2010-04-12

- http://lists.vmware.com/pipermail/security…010/000090.html
Synopsis: VMware hosted products, vCenter Server and ESX patches resolve multiple security issues…
Issue date: 2010-04-09
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042 CVE-2009-1564 CVE-2009-1565 CVE-2009-3732 CVE-2009-3707 CVE-2010-1138 CVE-2010-1139 CVE-2010-1141.
Change log: 2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion 2.0.7 on 2010-04-08…

- http://www.us-cert.gov/current/#vmware_rel…_advisory_vmsa4
April 9, 2010 - "… Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, operate with elevated privileges, obtain sensitive information, or cause a denial-of-service condition…"

- http://secunia.com/advisories/39206/
- http://secunia.com/advisories/39203/
- http://secunia.com/advisories/39201/
- http://secunia.com/advisories/39198/
- http://secunia.com/advisories/39110/
- http://secunia.com/advisories/36712/

FYI…

VMSA-2010-0008 VMware…

- http://www.vmware.com/security/advisories/…-2010-0008.html

- http://lists.vmware.com/pipermail/security…010/000092.html
May 5, 2010 - "Advisory ID: VMSA-2010-0008
Synopsis: VMware View 3.1.3 addresses an important cross-site scripting vulnerability
Issue date: 2010-05-05
CVE numbers: CVE-2010-1143 …

Release notes
- http://www.vmware.com/support/viewmanager3…manager313.html
View Manager Version 3.1.3
05 May 2010
Build: 252693 (View Manager), 161885 (View Composer)

Resolved Issues…
- http://www.vmware.com/support/viewmanager3…tml#fixedissues

FYI…

VMSA-2010-0009 ESXi utilities and ESX Service Console third party updates

- http://www.vmware.com/security/advisories/…-2010-0009.html

- http://lists.vmware.com/pipermail/security…010/000093.html
May 27, 2010 - Advisory ID: VMSA-2010-0009
Synopsis: ESXi utilities and ESX Service Console third party updates
Updated on: 2010-05-27 (initial release of advisory)
CVE numbers: CVE-2009-2695 CVE-2009-2908 CVE-2009-3228 CVE-2009-3286 CVE-2009-3547 CVE-2009-3613 CVE-2009-3612 CVE-2009-3620 CVE-2009-3621 CVE-2009-3726 CVE-2007-4567 CVE-2009-4536 CVE-2009-4537 CVE-2009-4538 CVE-2006-6304 CVE-2009-2910 CVE-2009-3080 CVE-2009-3556 CVE-2009-3889 CVE-2009-3939 CVE-2009-4020 CVE-2009-4021 CVE-2009-4138 CVE-2009-4141 CVE-2009-4272 CVE-2009-3563 CVE-2009-4355 CVE-2009-2409 CVE-2009-0590 CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1386 CVE-2009-1387 CVE-2009-4212 CVE-2009-1384 CVE-2010-0097 CVE-2010-0290 CVE-2009-3736 CVE-2010-0001 CVE-2010-0426 CVE-2010-0427 CVE-2010-0382
————————————————————————
Summary: ESXi update for ntp and ESX Console OS (COS) updates for COS kernel, openssl, krb5, gcc, bind, gzip, sudo…

VMSA-2010-0004.1 ESX Service Console and vMA third party updates
- http://lists.vmware.com/pipermail/security…010/000094.html
May 27, 2010

VMSA-2010-0002.1 VMware vCenter update release addresses multiple security issues in Java JRE
- http://lists.vmware.com/pipermail/security…010/000095.html
May 27, 2010

VMSA-2010-0002.2 VMware vCenter update release addresses multiple security issues in Java JRE
- http://lists.vmware.com/pipermail/security…010/000096.html
May 27, 2010

(-All- Secunia advisories listed below related to VMSA-2010-0009)

VMware vMA sudo Privilege Escalation Security Issues
- http://secunia.com/advisories/39981/
VMware vMA gzip "unlzw()" Integer Underflow Vulnerability
- http://secunia.com/advisories/39980/
VMware vMA GCC libtool Search Path Privilege Escalation Security Issue
- http://secunia.com/advisories/39979/
VMware vMA OpenSSL "CRYPTO_free_all_ex_data()" Memory Leak Vulnerability
- http://secunia.com/advisories/39976/
VMware ESX GCC libtool Search Path Privilege Escalation Security Issue
- http://secunia.com/advisories/39974/
VMware ESX Multiple krb5 Vulnerabilities
- http://secunia.com/advisories/39973/
VMware ESXi ntp Mode 7 Request Denial of Service
- http://secunia.com/advisories/39972/
VMware ESXi update for ntp
- http://secunia.com/advisories/39971/
VMware vMA kernel Multiple Vulnerabilities
- http://secunia.com/advisories/39920/
VMware vMA Multiple krb5 Vulnerabilities
- http://secunia.com/advisories/39977/
VMware ESX gzip "unlzw()" Integer Underflow Vulnerability
- http://secunia.com/advisories/39975/
VMware vMA ISC BIND DNSSEC CNAME / DNAME and NXDOMAIN Cache Poisoning
- http://secunia.com/advisories/39978/

FYI…

VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel

- http://www.vmware.com/security/advisories/…-2010-0010.html

- http://lists.vmware.com/pipermail/security…010/000098.html
Jun 24 22:37:26 PDT 2010 - "Advisory ID: VMSA-2010-0010
Synopsis: ESX 3.5 third party update for Service Console kernel
Issue date: 2010-06-24
Updated on: 2010-06-24 (initial release of advisory)
CVE numbers: CVE-2008-5029 CVE-2008-5300 CVE-2009-1337 CVE-2009-1385 CVE-2009-1895 CVE-2009-2848 CVE-2009-3002 CVE-2009-3547 CVE-2009-2698 CVE-2009-2692
- ————————————————————————
1. Summary: ESX 3.5 Console OS (COS) updates for COS package 'kernel'…
4. Solution: … http://kb.vmware.com/kb/1022899 …

- http://secunia.com/advisories/40368/
Release Date: 2010-06-25
Criticality level: Less critical
Impact: Security Bypass, Exposure of sensitive information, Privilege escalation, DoS
Where: From local network
Solution: Apply patch.

UPDATED VMSA-2010-0009.1 ESXi ntp and ESX Service Console third party updates
- http://lists.vmware.com/pipermail/security…010/000099.html
Issue date: 2010-05-27
Updated on: 2010-06-24

UPDATED VMSA-2010-0004.2 ESX Service Console and vMA third party updates
- http://lists.vmware.com/pipermail/security…010/000100.html
Issue date: 2010-03-03
Updated on: 2010-06-24

FYI…

VMSA-2010-0011 - VMware Studio
- http://secunia.com/advisories/40507/
Release Date: 2010-07-13
Impact: Privilege escalation, System access
Where: From local network
Solution Status: Vendor Patch
CVE Reference(s): CVE-2010-2427, CVE-2010-2667
Original Advisory: VMSA-2010-0011:
http://www.wmware.com/security/advisories/…-2010-0011.html
Summary: VMware Studio 2.1 addresses security vulnerabilities in virtual appliances created with Studio 2.0…

- http://securitytracker.com/alerts/2010/Jul/1024187.html
July 13 2010