VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages

               VMware Security Advisory

     Security best practices provided by VMware recommend that the
     service console be isolated from the VM network. Please see
     http://www.vmware.com/resources/techresources/726 for more
     information on VMware security best practices.

    An issue where attackers on the service console management
    network can cause a stack-based buffer overflow in the
    reply_netbios_packet function of nmbd in Samba. On systems
    where Samba is being used as a WINS server, exploiting this
    vulnerability can allow remote attackers to execute arbitrary
    code via crafted WINS Name Registration requests followed by a
    WINS Name Query request.

    An issue where attackers on the service console management
    network can exploit a vulnerability that occurs when Samba is
    configured as a Primary or Backup Domain controller. The
    vulnerability allows remote attackers to have an unknown impact
    via crafted GETDC mailslot requests, related to handling of
    GETDC logon server requests.

    The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
    has assigned the names CVE-2007-5398 and CVE-2007-4572 to these
    issues.

    This vulnerability can be exploited remotely only if the
    attacker has access to the service console network.

    Security best practices provided by VMware recommend that the
    service console be isolated from the VM network. Please see
    http://www.vmware.com/resources/techresources/726 for more
    information on VMware security best practices.

    RPM Updated:
    samba-3.0.9-1.3E.14.1vmw
    samba-client-3.0.9-1.3E.14.1vmw
    samba-common-3.0.9-1.3E.14.1vmw

    VM Shutdown: Yes
    Host Reboot: Yes

    ESX Server 3.5.0 is not affected by this issue

    ESX Server 3.0.2
    http://download3.vmware.com/software/vi/ESX-1002975.tgz
    md5sum: 797a7494c2c4eb49629d3f94818df5dd
    http://kb.vmware.com/kb/1002975

    ESX Server 3.0.1
    http://download3.vmware.com/software/vi/ESX-1002968.tgz
    md5sum: 5106d90afaf77c3a0d8433487f937d06
    http://kb.vmware.com/kb/1002968

    ESX Server 2.5.5 download Upgrade Patch 3
    ESX Server 2.5.4 download Upgrade Patch 14

    The patch addresses an issue where the mount and umount
    utilities in util-linux call the setuid and setgid functions in
    the wrong order and do not check the return values, which could
    allow attackers to gain elevated privileges via helper
    application such as mount.nfs.

    The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
    has assigned the name CVE-2007-5191 to this issue.

    RPM Updated:
    util-linux-2.11y-31.24vmw
    losetup-2.11y-31.24vmw
    mount -2.11y-31.24vmw

    VM Shutdown: Yes
    Host Reboot: Yes

    ESX Server 3.0.2
    http://download3.vmware.com/software/vi/ESX-1002976.tgz
    md5sum: 0fe833c50c0ecb0ff9340d6674be2e43
    http://kb.vmware.com/kb/1002976

    ESX Server 3.0.1
    http://download3.vmware.com/software/vi/ESX-1002972.tgz
    md5sum: 59ca4a43f330c5f0b7a55693aa952cdc
    http://kb.vmware.com/kb/1002972

    The update addresses an issue where the regular expression
    engine in Perl can be used to issue a specially crafted regular
    expression that allows the attacker to run arbitrary code with
    the permissions level of the current Perl user.

    The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
    has assigned the name CVE-2007-5116 to this issue.

    RPM Updated:
    perl-5.8.0-97.EL3

    VM Shutdown: Yes
    Host Reboot: Yes

    ESX Server 3.0.2
    http://download3.vmware.com/software/vi/ESX-1002971.tgz
    md5sum: 337b09d9ae4b1694a045e216b69765e1
    http://kb.vmware.com/kb/1002971

    ESX Server 3.0.1
    http://download3.vmware.com/software/vi/ESX-1002964.tgz
    md5sum: d47e26104bfd5e4018ae645638c94487
    http://kb.vmware.com/kb/1002964

    A flaw in the SSL_get_shared_ciphers&#40;&#41; function can allow an
    attacker to cause a buffer overflow problem by sending ciphers

    to applications that use the function.

    A possible vulnerability that would allow a local attacker to
    obtain private RSA keys being used on a system using the OpenSSL
    package.

    The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
    has assigned the names CVE-2007-3108, and CVE-2007-5135 to these
    issues.

    RPM Updated:
    openssl-0.9.7a-33.24

    VM Shutdown: Yes
    Host Reboot: Yes

    ESX Server 3.0.2
    http://download3.vmware.com/software/vi/ESX-1002969.tgz
    md5sum: 72fd28a9f9380158db149259fbdcaa3b
    http://kb.vmware.com/kb/1002969

    ESX Server 3.0.1
    http://download3.vmware.com/software/vi/ESX-1002962.tgz
    md5sum: a0727bdc2e1a6f00d5fe77430a6ee9d6
    http://kb.vmware.com/kb/1002962

    ESX Server 2.5.5 download Upgrade Patch 3
    ESX Server 2.5.4 download Upgrade Patch 14

VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages

Related