-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2010.0011.2
               ESX Service Console updates for nss and nspr
                               5 March 2010

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          ESX 4.0
                  vMA 4.0
Publisher:        VMWare
Operating System: VMWare ESX Server
                  Red Hat Enterprise Linux Server 5
Impact/Access:    Execute Arbitrary Code/Commands -- Remote with User Interaction
                  Provide Misleading Information  -- Remote/Unauthenticated      
Resolution:       Patch/Upgrade
CVE Names:        CVE-2009-3382 CVE-2009-3380 CVE-2009-3376
                  CVE-2009-3375 CVE-2009-3374 CVE-2009-3373
                  CVE-2009-3372 CVE-2009-3370 CVE-2009-3274
                  CVE-2009-2409 CVE-2009-2408 CVE-2009-2404
                  CVE-2009-1563  

Reference:        ASB-2009.1114
                  ESB-2009.1493
                  ESB-2009.1121.2

Revision History: March   5 2010: VMware updated stating: "Updated advisory after release of vMA Patch 3 on 2010-02-25"
                  January 8 2010: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2010-0001.1
Synopsis:          ESX Service Console and vMA updates for nss and nspr
Issue date:        2010-03-03
Updated on:        2010-01-06 (initial release of advisory)
CVE numbers:       CVE-2009-2409 CVE-2009-2408 CVE-2009-2404
                   CVE-2009-1563 CVE-2009-3274 CVE-2009-3370
                   CVE-2009-3372 CVE-2009-3373 CVE-2009-3374
                   CVE-2009-3375 CVE-2009-3376 CVE-2009-3380
                   CVE-2009-3382
- - ------------------------------------------------------------------------
1. Summary

   Update for Service Console and vMA for nss and nspr packages.

2. Relevant releases

   VMware ESX 4.0 without patch ESX400-200912403-SG

   vMA without Patch 3

3. Problem Description

 a. Update for Service Console packages nss and nspr

    Service console packages for Network Security Services (NSS) and
    NetScape Portable Runtime (NSPR) are updated to versions
    nss-3.12.3.99.3-1.2157 and nspr-4.7.6-1.2213 respectively. This
    patch fixes several security issues in the service console
    packages for NSS and NSPR.

    The Common Vulnerabilities and Exposures Project (cve.mitre.org)
    has assigned the names CVE-2009-2409, CVE-2009-2408, CVE-2009-2404,
    CVE-2009-1563, CVE-2009-3274, CVE-2009-3370, CVE-2009-3372,
    CVE-2009-3373, CVE-2009-3374, CVE-2009-3375, CVE-2009-3376,
    CVE-2009-3380, and CVE-2009-3382 to these issues.

    The following table lists what action remediates the vulnerability
    (column 4) if a solution is available.

    VMware         Product   Running  Replace with/
    Product        Version   on       Apply Patch
    =============  ========  =======  =================
    VirtualCenter  any       Windows  not affected

    hosted *       any       any      not affected

    ESXi           any       ESXi     not affected

    ESX            4.0       ESX      ESX400-200912403-SG
    ESX            3.5       ESX      not affected
    ESX            3.0.3     ESX      not affected
    ESX            3.0.2     ESX      not affected
    ESX            2.5.5     ESX      not affected

    vMA            4.0       RHEL5    Patch 3

  * hosted products are VMware Workstation, Player, ACE, Server, Fusion.

4. Solution

   Please review the patch/release notes for your product and version
   and verify the md5sum of your downloaded file.

   ESX 4.0
   -------
   ESX400-200912403-SG
 
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-181-20091231-153
046/ESX400-200912001.zip
   md5sum: 78c6cf139b7941dc736c9d3a41deae77
   sha1sum: 36df3a675fbd3c8c8830f00637e37ee716bdac59
   http://kb.vmware.com/kb/1016293

   To install an individual bulletin use esxupdate with the -b option.
   esxupdate --bundle=ESX400-200912001.zip -b ESX400-200912403-SG
   update

   vMA 4.0
   -------
   To update VIMA
       1 Log in to VIMA as vi-admin.
       2 type 'sudo /usr/sbin/vima-update update' this will apply all
         currently available updates.  See http://tinyurl.com/yfekgrx
         for more information.


5. References

   CVE numbers
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2404
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1563
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3274
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3370
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3372
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3373
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3374
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3375
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3376
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3380
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3382

- - ------------------------------------------------------------------------
6. Change log

2010-01-06  VMSA-2010-0001
Initial security advisory after release of patch ESX400-200912403-SG
for ESX 4.0 on 2010-01-06.
2010-03-03   VMSA-2010-0001.1
Updated advisory after release of vMA Patch 3 on 2010-02-25.

- - -----------------------------------------------------------------------
7. Contact

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

  * security-announce at lists.vmware.com
  * bugtraq at securityfocus.com
  * full-disclosure at lists.grok.org.uk

E-mail:  security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2010 VMware Inc.  All rights reserved.

- -----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.3 (Build 4028)
Charset: utf-8

wj8DBQFLj1L8S2KysvBH1xkRAsvhAJ0RtQ3wBCpSuyY2K1OQDU9IxNvMtACeKnkL
jWPSUSjtppeWY60K4LgCn2o=
=l0NU
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFLkDwq/iFOrG6YcBERAhw0AJ9QC7av+Y+KhoRyTl41lxxbu7qBxQCeKN6f
O1t4aaDDyTsy5Y41Mh4BBGY=
=8P77
-----END PGP SIGNATURE-----