===================================================================== CERT-Renater Note d'Information No. 2008/VULN218 _____________________________________________________________________ DATE : 17/06/2008 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running VMware ESX 3.5. ====================================================================== http://www.vmware.com/security/advisories/VMSA-2008-0010.html ______________________________________________________________________ VMSA-2008-0010 Updated Tomcat and Java JRE packages for VMware ESX 3.5 ---------------------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2008-00010 Synopsis: Updated Tomcat and Java JRE packages for VMware ESX 3.5 Issue date: 2008-06-16 Updated on: 2008-06-16 (initial release of advisory) CVE numbers: CVE-2007-5333 CVE-2007-5342 CVE-2007-5461 CVE-2007-6286 CVE-2008-1185 CVE-2008-1186 CVE-2008-1187 CVE-2008-1188 CVE-2008-1189 CVE-2008-1190 CVE-2008-1191 CVE-2008-1192 CVE-2008-1193 CVE-2008-1194 CVE-2008-1195 CVE-2008-1196 CVE-2008-0657 CVE-2007-5689 CVE-2007-5232 CVE-2007-5236 CVE-2007-5237 CVE-2007-5238 CVE-2007-5239 CVE-2007-5240 CVE-2007-5274 ---------------------------------------------------------------------------------- 1. Summary Updated Tomcat and Java JRE packages for VMware ESX 3.5 2. Relevant releases ESX 3.5 without patch ESX350-200806404-SG 3. Problem description Updated ESX fixes the following application vulnerabilities a. Tomcat Server Security Update This release of ESX updates the Tomcat Server package to version 5.5.26, which addresses multiple security issues that existed in earlier releases of Tomcat Server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-5333, CVE-2007-5342, CVE-2007-5461, CVE-2007-6286 to the security issues fixed in Tomcat 5.5.26. VMware Product Running Replace with/ Product Version on Apply Patch ======= ====== ======= ==================== Virtual- any Windows affected, patch pending Center hosted any any not affected ESXi 3.5 ESXi not affected ESX 3.5 ESX ESX350-200806404-SG ESX 3.0.2 ESX affected, patch pending ESX 3.0.1 ESX affected, patch pending ESX 2.5.5 ESX not affected ESX 2.5.4 ESX not affected b. JRE Security Update This release of ESX updates the JRE package to version 1.5.0_15, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-1185, CVE-2008-1186, CVE-2008-1187, CVE-2008-1188, CVE-2008-1189, CVE-2008-1190, CVE-2008-1191, CVE-2008-1192, CVE-2008-1193, CVE-2008-1194, CVE-2008-1195, CVE-2008-1196, CVE-2008-0657, CVE-2007-5689, CVE-2007-5232, CVE-2007-5236, CVE-2007-5237, CVE-2007-5238, CVE-2007-5239, CVE-2007-5240, CVE-2007-5274 to the security issues fixed in JRE 1.5.0_12, JRE 1.5.0_13, JRE 1.5.0_14, JRE 1.5.0_15. VMware Product Running Replace with/ Product Version on Apply Patch ======= ====== ======= ==================== Virtual- any Windows affected, patch pending Center hosted any any not affected ESXi 3.5 ESXi not affected ESX 3.5 ESX ESX350-200806404-SG ESX 3.0.2 ESX affected, patch pending ESX 3.0.1 ESX affected, patch pending ESX 2.5.5 ESX not affected ESX 2.5.4 ESX not affected Notes: These vulnerabilities can be exploited remotely only if the attacker has access to the service console network. Security best practices provided by VMware recommend that the service console be isolated from the VM network. Please see www.vmware.com/resources/techresources/726 for more information on VMware security best practices. The currently installed versions of Tomcat and JRE depend on your patch deployment history. 4. Solution Please review the Patch notes for your product and version and verify the md5sum of your downloaded file. ESX --- VMware ESX 3.5 patch ESX350-200806404-SG (Tomcat, JRE) download3.vmware.com/software/esx/ESX350-200806404-SG.zip md5sum: 669e97880a21cce13eb7e9051f403162 kb.vmware.com/kb/1005219 5. References Tomcat release notes tomcat.apache.org/security-5.html Sun release notes for j2se 1.5.0_x java.sun.com/j2se/1.5.0/ReleaseNotes.html CVE numbers cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi cve.mitre.org/cgi-bin/cvename.cgi 6. Change log 2008-06-16 VMSA-2008-0010 Initial release --------------------------------------------------------------------- 7. Contact E-mail list for product security notifications and announcements: lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: kb.vmware.com/kb/1055 VMware Security Center www.vmware.com/security VMware security response policy www.vmware.com/support/policies/security_response.html General support life cycle policy www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy www.vmware.com/support/policies/eos_vi.html Copyright 2008 VMware Inc. All rights reserved. ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================