Summary
The remote ESXi is missing one or more security related Updates from VMSA-2012-0001.
Summary
VMware ESXi and ESX updates to third party library and ESX Service Console address several security issues.
Relevant releases:
ESXi 4.1 without patch ESXi410-201201401-SG
ESXi 5.0 without patch ESXi500-201203101-SG
ESXi 4.0 without patch ESXi400-201203401-SG
ESX 4.1 without patches ESX410-201201401-SG, ESX410-201201402-SG, ESX410-201201404-SG, ESX410-201201405-SG, ESX410-201201406-SG, ESX410-201201407-SG.
Problem Description
a. ESX third party update for Service Console kernel
The ESX Service Console Operating System (COS) kernel is updated to kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the COS kernel.
b. ESX third party update for Service Console cURL RPM
The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9 resolving a security issue.
c. ESX third party update for Service Console nspr and nss RPMs
The ESX Service Console (COS) nspr and nss RPMs are updated to nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving a security issue.
A Certificate Authority (CA) issued fraudulent SSL certificates and Netscape Portable Runtime (NSPR) and Network Security Services (NSS) contain the built-in tokens of this fraudulent Certificate Authority. This update renders all SSL certificates signed by the fraudulent CA as untrusted for all uses.
d. ESX third party update for Service Console rpm RPMs
The ESX Service Console Operating System (COS) rpm packages are updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2, rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2 which fixes multiple security issues.
e. ESX third party update for Service Console samba RPMs
The ESX Service Console Operating System (COS) samba packages are updated to samba-client-3.0.33-3.29.el5_7.4, samba-common-3.0.33-3.29.el5_7.4 and libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security issues in the Samba client.
f. ESX third party update for Service Console python package
The ESX Service Console (COS) python package is updated to 2.4.3-44 which fixes multiple security issues.
g. ESXi update to third party component python
The python third party library is updated to python 2.5.6 which fixes multiple security issues.
Solution
Apply the missing patch(es).
References
Updated on 2015-03-25
Severity
Classification
-
CVSS Base Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- VMSA-2010-0016 VMware ESXi and ESX third party updates for Service Console and Likewise components
- VMSA-2010-0007: VMware hosted products, vCenter Server and ESX patches resolve multiple security issues
- VMSA-2012-0011 VMware Workstation, Player, Fusion, ESXi and ESX patches address security issues.
- VMSA-2015-0001: VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues
- VMSA-2014-0003 VMware vSphere Client updates address security vulnerabilities