| Descripción: | Summary:
The remote ESXi is missing one or more security related Updates from VMSA-2012-0001.
Vulnerability Insight:
VMware ESXi and ESX updates to third party library and ESX Service Console address
several security issues.
a. ESX third party update for Service Console kernel
The ESX Service Console Operating System (COS) kernel is updated to kernel-2.6.18-274.3.1.el5
to fix multiple security issues in the COS kernel.
b. ESX third party update for Service Console cURL RPM
The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9 resolving a security issue.
c. ESX third party update for Service Console nspr and nss RPMs
The ESX Service Console (COS) nspr and nss RPMs are updated to nspr-4.8.8-1.el5_7 and
nss-3.12.10-4.el5_7 respectively resolving a security issue.
A Certificate Authority (CA) issued fraudulent SSL certificates and Netscape
Portable Runtime (NSPR) and Network Security Services (NSS) contain the
built-in tokens of this fraudulent Certificate Authority. This update renders
all SSL certificates signed by the fraudulent CA as untrusted for all uses.
d. ESX third party update for Service Console rpm RPMs
The ESX Service Console Operating System (COS) rpm packages are updated to
popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2, rpm-libs-4.4.2.3-22.el5_7.2
and rpm-python-4.4.2.3-22.el5_7.2 which fixes multiple security issues.
e. ESX third party update for Service Console samba RPMs
The ESX Service Console Operating System (COS) samba packages are updated to
samba-client-3.0.33-3.29.el5_7.4, samba-common-3.0.33-3.29.el5_7.4 and
libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security issues in the
Samba client.
f. ESX third party update for Service Console python package
The ESX Service Console (COS) python package is updated to 2.4.3-44 which fixes
multiple security issues.
g. ESXi update to third party component python
The python third party library is updated to python 2.5.6 which fixes multiple
security issues.
Affected Software/OS:
ESXi 4.1 without patch ESXi410-201201401-SG
ESXi 5.0 without patch ESXi500-201203101-SG
ESXi 4.0 without patch ESXi400-201203401-SG
ESX 4.1 without patches ESX410-201201401-SG, ESX410-201201402-SG,
ESX410-201201404-SG, ESX410-201201405-SG, ESX410-201201406-SG,
ESX410-201201407-SG
Solution:
Apply the missing patch(es).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
