Solved

Is ESX 5.0.0 623860 affected by this vulnerability?

Posted on 2013-01-03
2
1,099 Views
Last Modified: 2013-01-04
I need to know if our particular build of VMware ESXi 5 is affected by this vulnerability:

                       VMware Security Advisory

Advisory ID:  VMSA-2012-0018
Synopsis:     VMware security updates for vCSA and ESXi
Issue date:   2012-12-20
Updated on:   2012-12-20 (initial advisory)
CVE numbers:  ------------- vCSA ---------------
              CVE-2012-6324, CVE-2012-6325
              ------------- glibc --------------
              CVE-2009-5029, CVE-2009-5064, CVE-2010-0830,
              CVE-2011-1089, CVE-2011-4609, CVE-2012-0864,
              CVE-2012-3404, CVE-2012-3405, CVE-2012-3406,
              CVE-2012-3480

- --------------------------------------------------------------------

1. Summary

   VMware has updated vCenter Server Appliance (vCSA) and ESX to 
   address multiple security vulnerabilities

2. Relevant releases

      vCenter Server Appliance 5.1 without Patch 1
      vCenter Server Appliance 5.0 without Update 2

      VMware ESXi 5.1 without patch ESXi510-201212101
      VMware ESXi 5.0 without patch ESXi500-201212101

3. Problem Description

   a. vCenter Server Appliance directory traversal

      The vCenter Server Appliance (vCSA) contains a directory
      traversal vulnerability that allows an authenticated 
      remote user to retrieve arbitrary files. Exploitation of
      this issue may expose sensitive information stored on the 
      server. 

      VMware would like to thank Alexander Minozhenko from ERPScan for
      reporting this issue to us.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the name CVE-2012-6324 to this issue.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        vCSA            5.1       Linux    vCSA 5.1 Patch 1
        vCSA            5.0       Linux    vCSA 5.0 Update 2

    b. vCenter Server Appliance arbitrary file download

      The vCenter Server Appliance (vCSA) contains an XML parsing 
      vulnerability that allows an authenticated remote user to
      retrieve arbitrary files.  Exploitation of this issue may
      expose sensitive information stored on the server.

      VMware would like to thank Alexander Minozhenko from ERPScan for
      reporting this issue to us.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the name CVE-2012-6325 to this issue.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        vCSA            5.1       Linux    not affected
        vCSA            5.0       Linux    vCSA 5.0 Update 2

c. Update to ESX glibc package

      The ESX glibc package is updated to version glibc-2.5-81.el5_8.1
      to resolve multiple security issues.

      The Common Vulnerabilities and Exposures project (cve.mitre.org)
      has assigned the names CVE-2009-5029, CVE-2009-5064,
      CVE-2010-0830, CVE-2011-1089, CVE-2011-4609, CVE-2012-0864
      CVE-2012-3404, CVE-2012-3405, CVE-2012-3406 and CVE-2012-3480
      to these issues.

      Column 4 of the following table lists the action required to
      remediate the vulnerability in each release, if a solution is
      available.

        VMware          Product   Running  Replace with/
        Product         Version   on       Apply Patch
        ==============  ========  =======  =================
        ESXi            5.1       ESXi     ESXi510-201212101
        ESXi            5.0       ESXi     ESXi500-201212101
        ESXi            4.1       ESXi     no patch planned
        ESXi            4.0       ESXi     no patch planned
        ESXi            3.5       ESXi     not applicable

        ESX             any       ESX      not applicable

4. Solution

   Please review the patch/release notes for your product and
   version and verify the checksum of your downloaded file.


   ESXi and ESX
   ------------
   The download for ESXi includes vCenter Server Appliance.


   https://downloads.vmware.com/go/selfsupport-download

   ESXi 5.1
   http://kb.vmware.com/kb/2035775

   ESXi 5.0
   http://kb.vmware.com/kb/2033751

5. References

      ------------- vCSA ---------------
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6324
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6325
      ------------- glibc --------------
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5029
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5064
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0830
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1089
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4609
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0864
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3404
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3405
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3406
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3480

- --------------------------------------------------------------------

6. Change log

   2012-12-20 VMSA-2012-0018
   Initial security advisory in conjunction with the release of
   vSphere 5.1 Patch 1 and vSphere 5.0 Update 2 on 2012-12-20.

- --------------------------------------------------------------------

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:

   * security-announce at lists.vmware.com
   * bugtraq at securityfocus.com
   * full-disclosure at lists.grok.org.uk

   E-mail: security at vmware.com
   PGP key at: http://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   VMware security response policy
   http://www.vmware.com/support/policies/security_response.html

   General support life cycle policy
   http://www.vmware.com/support/policies/eos.html

   VMware Infrastructure support life cycle policy
   http://www.vmware.com/support/policies/eos_vi.html

   Copyright 2012 VMware Inc. All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 10.2.0 (Build 2599)
Charset: utf-8

wj8DBQFQ01bsDEcm8Vbi9kMRAkXEAJoClYysvoV67RKiZ0uN1YszPcN0LQCg8QMV
OWjpV7Bnt27472i5EOhk9fI=
=jrDP
-----END PGP SIGNATURE-----

Open in new window


When I click on a ESXi host in vSphere I see the hostname followed by "ESXi, 5.0.0, 623860" but I see nothing that indicates that build or higher has or does not have the required patch.. but I do see that "VMware ESXi 5.0 without patch ESXi500-201212101" is affected.

How can I tell what patches my hosts currently have?
0
Comment
Question by:Thaidog
2 Comments
 
LVL 117

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE) earned 500 total points
ID: 38739923
your current build is affected, you need Build Number: 914586, which is also known as

ESXi 5.0 U2, released on 20 December 2012.

Download from VMware Patch Portal or use Update Manager to apply patch.

fyi Build  623860 is ESXi 5.0 U1. Which is affected by this security issue.

your build has these patches

which does not include

ESXi500-201212101

this was released in December 2012!
0
 
LVL 23

Expert Comment

by:Stelian Stan
ID: 38739924
To verify which patches are applied to your host open vmWare client > select the ESXi host > Update Manager > under "Patches" you should be able to see all the patches applied to that host.
0

Featured Post

Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Server 2008-R2 lost password 19 74
Go To/Delete Snapshot 10 24
Vmware Independent Disk 5 40
Inventory equipment in the office 7 12
It Is not possible to enable LLDP in vSwitch(at least is not supported by VMware), so in this article we will enable this, and also go trough how to enabled CDP and how to get this information in vSwitches and also in vDS.
HOW TO: Upload an ISO image to a VMware datastore for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5) using the vSphere Host Client, and checking its MD5 checksum signature is correct.  It's a good idea to compare checksums, because many installat…
Teach the user how to edit .vmx files to add advanced configuration options Open vSphere Web Client: Edit Settings for a VM: Choose VM Options -> Advanced: Add Configuration Parameters:
Teach the user how to join ESXi hosts to Active Directory domains Open vSphere Client: Join ESXi host to AD domain: Verify ESXi computer account in AD: Configure permissions for domain user in ESXi: Test domain user login to ESXi host:

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now