-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2008-00010 Synopsis: Updated Tomcat and Java JRE packages for VMware ESX 3.5 Issue date: 2008-06-16 Updated on: 2008-06-16 (initial release of advisory) CVE numbers: CVE-2007-5333 CVE-2007-5342 CVE-2007-5461 CVE-2007-6286 CVE-2008-1185 CVE-2008-1186 CVE-2008-1187 CVE-2008-1188 CVE-2008-1189 CVE-2008-1190 CVE-2008-1191 CVE-2008-1192 CVE-2008-1193 CVE-2008-1194 CVE-2008-1195 CVE-2008-1196 CVE-2008-0657 CVE-2007-5689 CVE-2007-5232 CVE-2007-5236 CVE-2007-5237 CVE-2007-5238 CVE-2007-5239 CVE-2007-5240 CVE-2007-5274 - ------------------------------------------------------------------- 1. Summary: Updated Tomcat and Java JRE packages for VMware ESX 3.5 2. Relevant releases: ESX 3.5 without patch ESX350-200806404-SG 3. Problem description: Updated ESX fixes the following application vulnerabilities a. Tomcat Server Security Update This release of ESX updates the Tomcat Server package to version 5.5.26, which addresses multiple security issues that existed in earlier releases of Tomcat Server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26. VMware Product Running Replace with/ Product Version on Apply Patch ======== ======== ======= ======================= Virtual- any Windows affected, patch pending Center hosted any any not affected ESXi 3.5 ESXi not affected ESX 3.5 ESX ESX350-200806404-SG ESX 3.0.2 ESX affected, patch pending ESX 3.0.1 ESX affected, patch pending ESX 2.5.5 ESX not affected ESX 2.5.4 ESX not affected b. JRE Security Update This release of ESX updates the JRE package to version 1.5.0_15, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187, CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195, CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232, CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239, CVE-2007-5240, CVE-2007-5274 to the security issues fixed in JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15. VMware Product Running Replace with/ Product Version on Apply Patch ======== ======== ======= ======================= Virtual- any Windows affected, patch pending Center hosted any any not affected ESXi 3.5 ESXi not affected ESX 3.5 ESX ESX350-200806404-SG ESX 3.0.2 ESX affected, patch pending ESX 3.0.1 ESX affected, patch pending ESX 2.5.5 ESX not affected ESX 2.5.4 ESX not affected Notes: These vulnerabilities can be exploited remotely only if the attacker has access to the service console network. Security best practices provided by VMware recommend that the service console be isolated from the VM network. Please see http://www.vmware.com/resources/techresources/726 for more information on VMware security best practices. The currently installed versions of Tomcat and JRE depend on your patch deployment history. 4. Solution: Please review the Patch notes for your product and version and verify the md5sum of your downloaded file. ESX --- VMware ESX 3.5 patch ESX350-200806404-SG (Tomcat, JRE) http://download3.vmware.com/software/esx/ESX350-200806404-SG.zip md5sum: 669e97880a21cce13eb7e9051f403162 http://kb.vmware.com/kb/1005219 5. References: Tomcat release notes http://tomcat.apache.org/security-5.html Sun release notes for j2se 1.5.0_x http://java.sun.com/j2se/1.5.0/ReleaseNotes.html CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5333 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5342 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5461 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6286 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1186 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1189 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1190 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1192 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1193 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1194 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1195 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1196 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0657 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5236 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5237 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5239 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5240 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274 6. Change log: 2008-06-16 VMSA-2008-0010 Initial release - --------------------------------------------------------------------- 7. Contact: E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Center http://www.vmware.com/security VMware security response policy http://www.vmware.com/support/policies/security_response.html General support life cycle policy http://www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html Copyright 2008 VMware Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.8.3 (Build 4028) Charset: utf-8 wj8DBQFIVzGHS2KysvBH1xkRAku0AJ9OtdBx+1/0tVm0yEQNMd1kTayIggCfdDi+ p7cvgH9ngsXnJuBgDA9Y98Y= =yjWv -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/