VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player

               VMware Security Advisory

 This release fixes a security vulnerability that could allow a
 guest operating system user with administrative privileges to cause
 memory corruption in a host process, and thus potentially execute
 arbitrary code on the host. &#40;CVE-2007-4496&#41;

 This release fixes a denial of service vulnerability that could
 allow a guest operating system to cause a host process to become
 unresponsive or exit unexpectedly. &#40;CVE-2007-4497&#41;

 Thanks to Rafal Wojtczvk of McAfee for identifying and reporting
 these issues.

 ESX
 ---
 VMware ESX 3.0.1 Download Patch Bundle ESX-8258730
 http://www.vmware.com/support/vi3/doc/esx-8258730-patch.html
 md5sum a06d0e36e403b0fe6bc6fbc76220a86d

 VMware ESX 3.0.0 Download Patch Bundle ESX-4809553
 http://www.vmware.com/support/vi3/doc/esx-4809553-patch.html
 md5sum cd363526aab5fa6c45bf2509cb5ae500

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available.

 VMware ESX 2.5.4 upgrade to patch 10 &#40;Build# 53326&#41;
 VMware ESX 2.5.3 upgrade to patch 13 &#40;Build# 52488&#41;
 VMware ESX 2.1.3 upgrade to patch  8 &#40;Build# 53228&#41;
 VMware ESX 2.0.2 upgrade to patch  8 &#40;Build# 52650&#41;

 NOTE: ESX 3.0.2 is not affected by this issue

 Hosted products
 ---------------
 VMware Workstation 6.0.0 upgrade to version 6.0.1 &#40;Build# 55017&#41;
 VMware Workstation 5.5.4 upgrade to version 5.5.5 &#40;Build# 56455&#41;
 VMware Player      2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware Player      1.0.4 upgrade to version 1.0.5 &#40;Build# 56455&#41;
 VMware Server      1.0.3 upgrade to version 1.0.4 &#40;Build# 56528&#41;
 VMware ACE         2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware ACE         1.0.3 upgrade to version 1.0.4 &#40;Build# 54075&#41;

 This release fixes several vulnerabilities in the DHCP server
 that could enable a specially crafted packets to gain system-level
 privileges. &#40;CVE-2007-0061, CVE-2007-0062, CVE-2007-0063&#41;

 Thanks to Neel Mehta and Ryan Smith of the IBM Internet Security
 Systems X-Force for discovering and researching these
 vulnerabilities.

 Hosted products
 ---------------
 VMware Workstation 6.0.0 upgrade to version 6.0.1 &#40;Build# 55017&#41;
 VMware Workstation 5.5.4 upgrade to version 5.5.5 &#40;Build# 56455&#41;
 VMware Player      2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware Player      1.0.4 upgrade to version 1.0.5 &#40;Build# 56455&#41;
 VMware Server      1.0.3 upgrade to version 1.0.4 &#40;Build# 56528&#41;
 VMware ACE         2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware ACE         1.0.3 upgrade to version 1.0.4 &#40;Build# 54075&#41;

 This release fixes a security vulnerability that could allow a
 malicious remote user to exploit the library file
 IntraProcessLogging.dll to overwrite files in a system.
 &#40;CVE-2007-4059&#41;

 This release fixes a security vulnerability that could allow a
 malicious remote user to exploit the library file vielib.dll to
 overwrite files in a system. &#40;CVE-2007-4155&#41;

 Thanks to the Goodfellas Security Research Team for discovering and
 researching these vulnerabilities.

 Hosted products
 ---------------
 VMware Workstation 6.0.0 upgrade to version 6.0.1 &#40;Build# 55017&#41;
 VMware Workstation 5.5.4 upgrade to version 5.5.5 &#40;Build# 56455&#41;
 VMware Player      2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware Player      1.0.4 upgrade to version 1.0.5 &#40;Build# 56455&#41;
 VMware Server      1.0.3 upgrade to version 1.0.4 &#40;Build# 56528&#41;
 VMware ACE         2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware ACE         1.0.3 upgrade to version 1.0.4 &#40;Build# 54075&#41;

 This release fixes a security vulnerability in which Workstation
 was starting registered Windows services in an insecure manner.
 This vulnerability could allow a malicious user to escalate user
 privileges.

 Thanks to Foundstone for discovering this vulnerability.

 Hosted products
 ---------------
 VMware Workstation 6.0.0 upgrade to version 6.0.1 &#40;Build# 55017&#41;
 VMware Workstation 5.5.4 upgrade to version 5.5.5 &#40;Build# 56455&#41;
 VMware Player      2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware Player      1.0.4 upgrade to version 1.0.5 &#40;Build# 56455&#41;
 VMware Server      1.0.3 upgrade to version 1.0.4 &#40;Build# 56528&#41;
 VMware ACE         2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware ACE         1.0.3 upgrade to version 1.0.4 &#40;Build# 54075&#41;

 This release fixes a problem that prevented VMware Player from
 launching. This problem was accompanied by the error message VMware
 Player unrecoverable error: &#40;player&#41; Exception 0xc0000005 &#40;access
 violation&#41; has occurred.

 Hosted products
 ---------------
 VMware Player      2.0.0 upgrade to version 2.0.1 &#40;Build# 55017&#41;
 VMware Player      1.0.4 upgrade to version 1.0.5 &#40;Build# 56455&#41;

 Various bugs were found in NDR parsing, used to decode MS-RPC
 requests in Samba. A remote attacker could have sent carefully
 crafted requests causing a heap overflow, which may have led to the
 ability to execute arbitrary code on the server. &#40;CVE-2007-2446&#41;

 Unescaped user input parameters were being passed as arguments to
 /bin/sh. A remote, authenticated, user could have triggered this
 flaw and executed arbitrary code on the server. Additionally, this
 flaw could be triggered by a remote unauthenticated user if Samba
 was configured to use the non-default username map script option.
 &#40;CVE-2007-2447&#41;

 Thanks to the Samba developers, TippingPoint, and iDefense for
 identifying and reporting these issues.

 Note: These issues only affect the service console network, and are
 not remote vulnerabilities for ESX Server hosts that have been set
 up with the security best practices provided by VMware.
 http://www.vmware.com/resources/techresources/726

 ESX
 ---
 VMware ESX 3.0.1 Download Patch Bundle ESX-1001213
 http://www.vmware.com/support/vi3/doc/esx-1001213-patch.html
 md5sum 4e942e5b47f90654696910fb8b10b144

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001204
 http://www.vmware.com/support/vi3/doc/esx-1001204-patch.html
 md5sum 08bfdec038ea900c72f04e8d50b2db62

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 VMware ESX 2.5.4 prior to upgrade patch 10 &#40;Build# 53326&#41;
 VMware ESX 2.5.3 prior to upgrade patch 13 &#40;Build# 52488&#41;
 VMware ESX 2.1.3 prior to upgrade patch  8 &#40;Build# 53228&#41;
 VMware ESX 2.0.2 prior to upgrade patch  8 &#40;Build# 52650&#41;

 NOTE: ESX 3.0.2 is not affected by this issue

 ISC BIND &#40;Berkeley Internet Name Domain&#41; is an implementation of
 the DNS &#40;Domain Name System&#41; protocols. Under some circumstances, a
 malicious remote user could launch a Denial-of-Service attack on
 ESX Server hosts that had enabled DNSSEC validation.
 &#40;CVE-2007-0494&#41;

 Note: These issues only affect the service console network, and are
 not remote vulnerabilities for ESX Server hosts that have been set
 up with the security best practices provided by VMware.
 http://www.vmware.com/resources/techresources/726

 ESX
 ---
 VMware ESX 3.0.2 Download Patch Bundle ESX-1001725
 http://www.vmware.com/support/vi3/doc/esx-1001725-patch.html
 md5sum 75aa49eecec2e84eb41a4c26683d4c7a

 VMware ESX 3.0.1 Download Patch Bundle ESX-1001691
 http://www.vmware.com/support/vi3/doc/esx-1001691-patch.html
 md5sum e288a71c4953aa6724ce53879c663f81

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001206
 http://www.vmware.com/support/vi3/doc/esx-1001206-patch.html
 md5sum bd552eb70624164067039525941ce82a

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 VMware ESX 2.5.4 prior to upgrade patch 10 &#40;Build# 53326&#41;
 VMware ESX 2.5.3 prior to upgrade patch 13 &#40;Build# 52488&#41;
 VMware ESX 2.1.3 prior to upgrade patch  8 &#40;Build# 53228&#41;
 VMware ESX 2.0.2 prior to upgrade patch  8 &#40;Build# 52650&#41;

 The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
 assigned the names CVE-2007-2442, CVE-2007-2443, and CVE-2007-2798
 to these security issues.

 Thanks to Wei Wang of McAfee Avert Labs discovered these
 vulnerabilities.

 Note: The VMware service console does not provide the kadmind
 binary, and is not affected by these issues, but a update has been
 provided for completeness.

 ESX
 ---
 VMware ESX 3.0.2 Download Patch Bundle ESX-1001731
 http://www.vmware.com/support/vi3/doc/esx-1001731-patch.html
 md5sum c349b83065f5b06cee34bae90a5a01b3

 VMware ESX 3.0.1 Download Patch Bundle ESX-1001723
 http://www.vmware.com/support/vi3/doc/esx-1001723-patch.html
 md5sum 9a31d1718d6c063cf978305b84637c40

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001212
 http://www.vmware.com/support/vi3/doc/esx-1001212-patch.html
 md5sum 2bc08369d3410fa59d353e45830ae9f5

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 VMware ESX 2.5.4 prior to upgrade patch 10 &#40;Build# 53326&#41;
 VMware ESX 2.5.3 prior to upgrade patch 13 &#40;Build# 52488&#41;
 VMware ESX 2.1.3 prior to upgrade patch  8 &#40;Build# 53228&#41;
 VMware ESX 2.0.2 prior to upgrade patch  8 &#40;Build# 52650&#41;

 This patch provides an updated service console package vixie-cron.
 Cron is a standard UNIX daemon that runs specified programs at
 scheduled times.

 A denial of service issue was found in the way vixie-cron verified
 crontab file integrity. A local user with the ability to create a
 hardlink to /etc/crontab could potentially prevent vixie-cron from
 executing certain system cron jobs. &#40;CVE-2007-1856&#41;

 Thanks to Raphael Marichez for identifying this issue.

 ESX
 ---
 VMware ESX 3.0.1 Download Patch Bundle ESX-1001214
 http://www.vmware.com/support/vi3/doc/esx-1001214-patch.html
 md5sum 1e63db1cc7605830b16306a35bccd878

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001205
 http://www.vmware.com/support/vi3/doc/esx-1001205-patch.html
 md5sum e6b818cf885d5fd5f93d33b27051df83

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 NOTE: ESX 3.0.2 and ESX 2.x are not affected by this issue.

 This patch provides an updated shadow-utils package.  A new
 user&#39;s mailbox, when created, could have random permissions for a
 short period. This could enable a local malicious user to
 read or modify the mailbox. &#40;CVE-2006-1174&#41;

 ESX
 ---
 VMware ESX 3.0.2 Download Patch Bundle ESX-1001726
 http://www.vmware.com/support/vi3/doc/esx-1001726-patch.html
 md5sum ac55c65ddc2142a292648765e9dcb583

 VMware ESX 3.0.1 Download Patch Bundle ESX-1001692
 http://www.vmware.com/support/vi3/doc/esx-1001692-patch.html
 md5sum 27edbac467107cc1fe6c78a839ce2144

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001207
 http://www.vmware.com/support/vi3/doc/esx-1001207-patch.html
 md5sum acad9bce49ac9398ab1ee502980b49cb

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 This patch provides a updated OpenLDAP package. A flaw could
 allow users with selfwrite access to modify the distinguished
 name of any user, instead of being limited to modify only
 their own distinguished name. &#40;CVE-2006-4600&#41;

 ESX
 ---
 VMware ESX 3.0.2 Download Patch Bundle ESX-1001727
 http://www.vmware.com/support/vi3/doc/esx-1001727-patch.html
 md5sum bd137cbf65b20dae3aaf422a559f92a1

 VMware ESX 3.0.1 Download Patch Bundle ESX-1001693
 http://www.vmware.com/support/vi3/doc/esx-1001693-patch.html
 md5sum a11191b59761b6afb68ea73e9e6456d0

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001208
 http://www.vmware.com/support/vi3/doc/esx-1001208-patch.html
 md5sum f3e26b66682191e024a9b094a063837f

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 NOTE: ESX 2.x doesen&#39;t ship OpenLDAP

 This patch provides an updated PAM package A vulnerability was
 found that could allow console users with access to certain device
 files to cause damage to recordable CD drives. Certain file
 permissions have now been modified to disallow access.
 &#40;CVE-2004-0813&#41;

 A flaw was found with console device permissions. It was possible
 for various console devices to retain ownership of the previoius
 console user after logging out, which could result in leakage of
 information to an unauthorized user. &#40;CVE-2007-1716&#41;

 ESX
 ---
 VMware ESX 3.0.2 Download Patch Bundle ESX-1001728
 http://www.vmware.com/support/vi3/doc/esx-1001728-patch.html
 md5sum a33f0cc5b1cfc68683c4d8643c52775c

 VMware ESX 3.0.1 Download Patch Bundle ESX-1001694
 http://www.vmware.com/support/vi3/doc/esx-1001694-patch.html
 md5sum 6ce5d882d6fe9e714ce48f719cefb182

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001209
 http://www.vmware.com/support/vi3/doc/esx-1001209-patch.html
 md5sum 1c7adad00a20f9e7ba1fbe1663ad4d66

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 This patch provides security fixes for the service console GNU
 Compiler Collection &#40;GCC&#41; packages that include C, C++, Java,
 Fortran 77, Objective C, and Ada 95 GNU compilers and related
 support libraries.

 A flaw was found in the fastjar utility that could potentially
 allow a malicious user to create a JAR file which, if unpacked
 using fastjar, could write to any file that an authorized user had
 write access to. &#40;CVE-2006-3619&#41;

 Thanks to J&#252;rgen Weigert for identifying this issue.

 ESX
 ---
 VMware ESX 3.0.2 Download Patch Bundle ESX-1001729
 http://www.vmware.com/support/vi3/doc/esx-1001729-patch.html
 md5sum 1b2d32dc805971703bb2c8c047c6144a

 VMware ESX 3.0.1 Download Patch Bundle ESX-8253547
 http://www.vmware.com/support/vi3/doc/esx-8253547-patch.html
 md5sum 90702b54fb6197a6680f141ad8c435fa

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001210
 http://www.vmware.com/support/vi3/doc/esx-1001210-patch.html
 md5sum c1fb76ac529966bf65cc98cc5e5e88bb

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

 This patch provides a security fix for the service console GNU
 debugger &#40;GDB&#41;.  Various vulnerabilities were found in GDB. These
 vulnerabilities may allow a malicious user to deceive a user into
 loading debugging information into GDB, enabling the execution of
 arbitrary code with the privileges of the user. &#40;CVE-2006-4146&#41;

 ESX
 ---
 VMware ESX 3.0.2 Download Patch Bundle ESX-1001730
 http://www.vmware.com/support/vi3/doc/esx-1001730-patch.html
 md5sum 7f91450c665065c9998a635bbe4c42db

 VMware ESX 3.0.1 Download Patch Bundle ESX-8567382
 http://www.vmware.com/support/vi3/doc/esx-8567382-patch.html
 md5sum 230a7c7ceec8bd581110ef9303a480fc

 VMware ESX 3.0.0 Download Patch Bundle ESX-1001211
 http://www.vmware.com/support/vi3/doc/esx-1001211-patch.html
 md5sum 3f30f6a1a28e6ff4c10d5e44864d327e

 NOTE: ESX 3.0.0 is nearing its End-of-life &#40;10/05/2007&#41; users
 should upgrade to at least 3.0.1 and preferably the newest
 release available

VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player

Workstation 6.0.1

Workstation 5.5.5

Server 1.0.4

ACE 2.0.1 and 1.0.4

Player 2.0.1 and 1.0.5

VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player

Workstation 6.0.1

Workstation 5.5.5

Server 1.0.4

ACE 2.0.1 and 1.0.4

Player 2.0.1 and 1.0.5

Related