VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 1

2006-11-1400:00:00

vulners.com

JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

               VMware Security Advisory

Advisory ID: VMSA-2006-0005
Synopsis: VMware ESX Server 2.5.4 Upgrade Patch 1
Patch URL: http://www.vmware.com/download/esx/esx-254-200610-patch.html
Issue date: 2006-10-31
Updated on: 2006-11-13
CVE Names: CVE-2005-2177 CVE-2006-3467 CVE-2006-1056
CVE-2006-1342 CVE-2006-1343 CVE-2006-1864
CVE-2006-2071

Summary:

Updated package addresses several security issues.

Relevant releases:

VMware ESX 2.5.4 prior to upgrade patch 1

Problem description:

This patch addresses the following security issues:

ucd-snmp – A denial of service bug was found in the way ucd-snmp uses
network stream protocols. A remote attacker could send a ucd-snmp agent
a specially crafted packet which will cause the agent to crash. The
Common Vulnerabilities and Exposures project (cve.mitre.org) assigned
the name CAN-2005-2177 to this issue.

XFree86 – An integer overflow flaw in the way the XFree86 server
processes PCF font files was discovered. A malicious authorized client
could exploit this issue to cause a denial of service (crash) or
potentially execute arbitrary code with root privileges on the XFree86
server. The Common Vulnerabilities and Exposures project (cve.mitre.org)
assigned the name CVE-2006-3467 to this issue.

An AMD fxsave/restore security vulnerability. The instructions fxsave
and fxrstor on AMD CPUs are used to save or restore the FPU registers
(FOP, FIP and FDP). On AMD Opteron processors, these instructions do not
save/restore some exception related registers unless an exception is
currently being serviced. This could allow a local attacker to partially
monitor the execution path of FPU processes, possibly allowing them to
obtain sensitive information being passed through those processes. The
Common Vulnerabilities and Exposures project (cve.mitre.org) assigned
the name CVE-2006-1056 to this issue.

A minor info leak in socket name handling in the network code
(CVE-2006-1342).
A minor info leak in socket option handling in the network code
(CVE-2006-1343).
A directory traversal vulnerability in smbfs that allowed a local user
to escape chroot restrictions for an SMB-mounted filesystem via "…\\"
sequences (CVE-2006-1864).
A flaw in the mprotect system call that allowed to give write permission
to a readonly attachment of shared memory (CVE-2006-2071).

The non-security-related fixes are documented on the patch download page.