-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2006-0005 Synopsis: VMware ESX Server 2.5.4 Upgrade Patch 1 Patch URL: http://www.vmware.com/download/esx/esx-254-200610-patch.html Issue date: 2006-10-31 Updated on: 2006-11-13 CVE Names: CVE-2005-2177 CVE-2006-3467 CVE-2006-1056 CVE-2006-1342 CVE-2006-1343 CVE-2006-1864 CVE-2006-2071 - - ------------------------------------------------------------------- 1. Summary: Updated package addresses several security issues. 2. Relevant releases: VMware ESX 2.5.4 prior to upgrade patch 1 3. Problem description: This patch addresses the following security issues: ucd-snmp -- A denial of service bug was found in the way ucd-snmp uses network stream protocols. A remote attacker could send a ucd-snmp agent a specially crafted packet which will cause the agent to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CAN-2005-2177 to this issue. XFree86 -- An integer overflow flaw in the way the XFree86 server processes PCF font files was discovered. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the XFree86 server. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-3467 to this issue. An AMD fxsave/restore security vulnerability. The instructions fxsave and fxrstor on AMD CPUs are used to save or restore the FPU registers (FOP, FIP and FDP). On AMD Opteron processors, these instructions do not save/restore some exception related registers unless an exception is currently being serviced. This could allow a local attacker to partially monitor the execution path of FPU processes, possibly allowing them to obtain sensitive information being passed through those processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-1056 to this issue. A minor info leak in socket name handling in the network code (CVE-2006-1342). A minor info leak in socket option handling in the network code (CVE-2006-1343). A directory traversal vulnerability in smbfs that allowed a local user to escape chroot restrictions for an SMB-mounted filesystem via "..\\" sequences (CVE-2006-1864). A flaw in the mprotect system call that allowed to give write permission to a readonly attachment of shared memory (CVE-2006-2071). The non-security-related fixes are documented on the patch download page. 4. Solution: Upgrade to the latest update package for your release of ESX. http://www.vmware.com/download/esx/ http://www.vmware.com/download/esx/esx-254-200610-patch.html The md5 checksum output should match the following: 6bc66a5cdbfea08f762f375f2488998b esx-2.5.4-32461-upgrade.tar.gz 5. References: http://www.vmware.com/download/esx/esx-254-200610-patch.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2177 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3467 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1056 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1342 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1343 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1864 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2071 http://www.vmware.com/products/esx/ http://www.vmware.com/download/esx/ 6. Contact: http://www.vmware.com/security VMware Security Response Policy http://www.vmware.com/vmtn/technology/security/security_response.html E-mail: security@vmware.com Copyright 2006 VMware Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFFWP4q6KjQhy2pPmkRCJLcAKC8hclWfRdKXjT8RfYEsLykp1lcOQCfZvve Wm8ulAa7VayW5kYj/a75mcg= =rbyq -----END PGP SIGNATURE-----