VMSA-2006-0004 Cross site scripting vulnerability and other fixes

[VMware Security Team <security () vmware com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


- -------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID:       VMSA-2006-0004
Synopsis:          Cross site scripting vulnerability and other fixes
Knowledge base URL:http://kb.vmware.com/kb/2118366
Issue date:        2006-07-27
Updated on:        2006-07-27
CVE Names:         CVE-2005-3618 CVE-2005-3620 CVE-2006-2481
- -------------------------------------------------------------------

1. Summary:

Several security issues affecting ESX 2.5.x

VMware has rated this as a Priority 1 security issue according to 
Vmware's Security Response Policy. See
http://www.vmware.com/vmtn/technology/security/security_response.html

2. Relevant releases:

VMware ESX 2.5.3 prior to upgrade patch 2
VMware ESX 2.1.3 prior to upgrade patch 1
VMware ESX 2.0.2 prior to upgrade patch 1

3. Problem description:

The three vulnerabilities have been assigned names by the Common 
Vulnerabilities and Exposures (CVE) project, as follows:

CVE-2005-3618: An unauthorized user could potentially construct a 
specially crafted URL that may change a known user's password.

CVE-2005-3620: A local user could view potentially sensitive 
information.

CVE-2006-2481: If an attacker can gain access to browser cookies 
by any mechanism, such as through a cross site scripting attack, 
then they could acquire not only the session ID, but the 
authentication credentials. NOTE:  This issue was fixed in ESX 2.5.3, 
ESX 2.5.2 Patch 4, ESX 2.0.2 and later.

4. Solution:

Upgrade to the latest update package for your release of ESX. 
http://www.vmware.com/download/esx/

Installing the Update

This update requires you to boot your server into Linux mode to perform 
the upgrade. When you are prompted to reboot at the end of the upgrade, 
the installer will restart your system to run ESX Server.

   1. Power off all virtual machines and shutdown your server.
   2. Restart your system.
   3. At the LILO Boot Menu, select the linux option. Allow the system 
      start procedure to complete.
   4. Log in as root into the ESX Server service console, in Linux mode. 
      Make sure your path variable contains /usr/bin:/bin.
   5. Download the tar file into a temporary directory under /root on 
      your ESX service console.
   6. Change directories to that temporary directory.
   7. Verify the integrity of the package for your version:
      # md5sum esx-*-upgrade.tar.gz

      The md5 checksum output should match one of the following:
        50c3260176c8cc33ad3bc880a20a4656 esx-2.5.3-28065-upgrade.tar.gz 
        ddb67afe2a48a04fb764af2497d6b75c esx-2.5.3-27728-upgrade.tar.gz 
        ce112a1d17893fbe5b47dfb011468269 esx-2.1.3-27733-upgrade.tar.gz 
        7f9b2367bbc54f29586ade0e1e286837 esx-2.0.2-27920-upgrade.tar.gz 

   8. Extract the compressed tar archive:
      # tar -xvzf esx-2.5.3-28065-upgrade.tar.gz
   9. Change directories to the newly created directory 
      # cd esx-2.5.3-28065-upgrade
  10. Run the patch installer:
      # /usr/bin/perl ./upgrade.pl

      Note: Once you start the installation script, do not enter keyboard 
            escape commands such as Control-C or Control-D. Using escape 
            commands will interrupt the upgrade procedure and leave your 
            system partially upgraded.

  11. The system updates have now been installed. A reboot prompt displays:
      Reboot the server now [y/n]?

      This update will not be complete until you reboot the ESX Server. If 
      you enter N, to indicate that you will not reboot at this time, ESX 
      Server displays the warning message: 

      "Please reboot the server manually for this update to take effect. 
       Update has been terminated unexpectedly." 

      If you see this message, you must manually reboot the server to complete 
      the driver update.

  12. At the reboot prompt, enter Y to reboot the server.

7. References:

http://www.corsaire.com/
http://www.corsaire.com/advisories/c060512-001.txt
http://www.corsaire.com/advisories/c051114-002.txt
http://www.corsaire.com/advisories/c051114-002.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3618 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3620
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2481
http://www.vmware.com/products/esx/
http://www.vmware.com/download/esx/

8. Acknowledgments

VMware would like to thank Stephen de Vries and Martin O'Neal of the 
security consultancy Corsaire Limited, <http://www.corsaire.com/>.

9. Contact:

http://www.vmware.com/security

Copyright 2006 VMware Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFEzrZbLsZLrftG15MRAmhEAKDdG3ivyE1CbJ97Tj5vD1D2LWLJiQCgotYh
9qAHbV4xEJHN0Y0GeIFzR8M=
=lRxp
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/