VMware Security Advisory - Updated Tomcat and Java JRE packages have been made available for VMWare ESX 3.5. It is not a few updates either. Check out how many CVEs are covered. Judging by the CVE age, their turn around time on patching is quite sad.
bdca972198318dc99cbe922fcffca76537d29df7f9248d8962802a8c0051113f-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2008-00010
Synopsis: Updated Tomcat and Java JRE packages for VMware
ESX 3.5
Issue date: 2008-06-16
Updated on: 2008-06-16 (initial release of advisory)
CVE numbers: CVE-2007-5333 CVE-2007-5342 CVE-2007-5461
CVE-2007-6286 CVE-2008-1185 CVE-2008-1186
CVE-2008-1187 CVE-2008-1188 CVE-2008-1189
CVE-2008-1190 CVE-2008-1191 CVE-2008-1192
CVE-2008-1193 CVE-2008-1194 CVE-2008-1195
CVE-2008-1196 CVE-2008-0657 CVE-2007-5689
CVE-2007-5232 CVE-2007-5236 CVE-2007-5237
CVE-2007-5238 CVE-2007-5239 CVE-2007-5240
CVE-2007-5274
- -------------------------------------------------------------------
1. Summary:
Updated Tomcat and Java JRE packages for VMware ESX 3.5
2. Relevant releases:
ESX 3.5 without patch ESX350-200806404-SG
3. Problem description:
Updated ESX fixes the following application vulnerabilities
a. Tomcat Server Security Update
This release of ESX updates the Tomcat Server package to version
5.5.26, which addresses multiple security issues that existed
in earlier releases of Tomcat Server.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461,
CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26.
VMware Product Running Replace with/
Product Version on Apply Patch
======== ======== ======= =======================
Virtual- any Windows affected, patch pending
Center
hosted any any not affected
ESXi 3.5 ESXi not affected
ESX 3.5 ESX ESX350-200806404-SG
ESX 3.0.2 ESX affected, patch pending
ESX 3.0.1 ESX affected, patch pending
ESX 2.5.5 ESX not affected
ESX 2.5.4 ESX not affected
b. JRE Security Update
This release of ESX updates the JRE package to version 1.5.0_15,
which addresses multiple security issues that existed in
earlier releases of JRE.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187,
CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191,
CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195,
CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232,
CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239,
CVE-2007-5240, CVE-2007-5274 to the security issues fixed in
JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15.
VMware Product Running Replace with/
Product Version on Apply Patch
======== ======== ======= =======================
Virtual- any Windows affected, patch pending
Center
hosted any any not affected
ESXi 3.5 ESXi not affected
ESX 3.5 ESX ESX350-200806404-SG
ESX 3.0.2 ESX affected, patch pending
ESX 3.0.1 ESX affected, patch pending
ESX 2.5.5 ESX not affected
ESX 2.5.4 ESX not affected
Notes: These vulnerabilities can be exploited remotely only if the
attacker has access to the service console network.
Security best practices provided by VMware recommend that the
service console be isolated from the VM network. Please see
https://www.vmware.com/resources/techresources/726 for more
information on VMware security best practices.
The currently installed versions of Tomcat and JRE depend
on your patch deployment history.
4. Solution:
Please review the Patch notes for your product and version and verify
the md5sum of your downloaded file.
ESX
---
VMware ESX 3.5 patch ESX350-200806404-SG (Tomcat, JRE)
https://download3.vmware.com/software/esx/ESX350-200806404-SG.zip
md5sum: 669e97880a21cce13eb7e9051f403162
https://kb.vmware.com/kb/1005219
5. References:
Tomcat release notes
https://tomcat.apache.org/security-5.html
Sun release notes for j2se 1.5.0_x
https://java.sun.com/j2se/1.5.0/ReleaseNotes.html
CVE numbers
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5333
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5342
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5461
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6286
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1185
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1186
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1187
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1188
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1189
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1190
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1191
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1192
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1193
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1194
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1195
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1196
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0657
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5689
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5236
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5237
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5239
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5240
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274
6. Change log:
2008-06-16 VMSA-2008-0010 Initial release
- ---------------------------------------------------------------------
7. Contact:
E-mail list for product security notifications and announcements:
https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: https://kb.vmware.com/kb/1055
VMware Security Center
https://www.vmware.com/security
VMware security response policy
https://www.vmware.com/support/policies/security_response.html
General support life cycle policy
https://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
https://www.vmware.com/support/policies/eos_vi.html
Copyright 2008 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8
wj8DBQFIVzGHS2KysvBH1xkRAku0AJ9OtdBx+1/0tVm0yEQNMd1kTayIggCfdDi+
p7cvgH9ngsXnJuBgDA9Y98Y=
=yjWv
-----END PGP SIGNATURE-----
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed