-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------
~                   VMware Security Advisory

Advisory ID:       VMSA-2008-0004
Synopsis:          Low: Updated e2fsprogs service console package
Issue date:        2008-03-03
Updated on:        2008-03-03 (initial release of advisory)
CVE numbers:       CVE-2007-5497
- -------------------------------------------------------------------

1. Summary:

Updated service console package e2fsprogs.

2. Relevant releases:

ESX Server 2.5.5 Upgrade Patch 5
ESX Server 2.5.4 Upgrade Patch 16

NOTE: ESX 2.5.4 is in Extended Support and its end of support (Security
~      and Bug fixes) is 10/08/2008.  Users should plan to upgrade to at
~      least 2.5.5 and preferably the newest release available before
~      the end of extended support.

~      ESX Server prior to 2.5.4 are no longer in Extended Support.
~      Users should upgrade to a supported version of the product.

~      The VMware Infrastructure Support Life Cycle Policy can be found
~      here: http://www.vmware.com/support/policies/eos_vi.html

3. Problem description:

Updated e2fsprogs package address multiple integer overflow flaws

Thanks to Rafal Wojtczuk of McAfee Avert Research for identifying
and reporting this issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2007-5497 to this issue.

4. Solution:

Please review the Patch notes for your product and version and verify
the md5sum of your downloaded file.

ESX Server 2.x Patches:
http://www.vmware.com/download/esx/esx2_patches.html

ESX Server 2.5.5 Upgrade Patch 5
http://download3.vmware.com/software/esx/esx-2.5.5-73417-upgrade.tar.gz
md5sum: cf0addac42cb2057c47065971f56bee6
http://www.vmware.com/support/esx25/doc/esx-255-200802-patch.html

ESX Server 2.5.4 Upgrade Patch 16
http://download3.vmware.com/software/esx/esx-2.5.4-73416-upgrade.tar.gz
md5sum: b7b2cbfd45380124c128831dca8bc2b0
http://www.vmware.com/support/esx25/doc/esx-254-200802-patch.html

5. References:

~   CVE numbers
~   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5497

- -------------------------------------------------------------------
6. Contact:

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

~  * security-announce@lists.vmware.com
~  * bugtraq@securityfocus.com
~  * full-disclosure@lists.grok.org.uk

E-mail:  security@vmware.com

Security web site
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2008 VMware Inc.  All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFHzHdoS2KysvBH1xkRCCxrAJsHDTczV7agRyav5nMXgVmvMKTsSACfTmLl
Rv1wQy510KaPTQy9LiNMTNo=
=yM44
-----END PGP SIGNATURE-----