SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   VMware ESXi Vendors:   VMware
(VMware Issues Fix for VMware ESX) Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1019731
SecurityTracker URL:  http://securitytracker.com/id/1019731
CVE Reference:   CVE-2007-6284   (Links to External Site)
Date:  Mar 31 2008
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): VMware ESX 2.5.5 before Upgrade Patch 6, VMware ESX 2.5.4 before Upgrade Patch 17
Description:   A vulnerability was reported in Libxml2. A remote user can cause denial of service conditions. VMware ESX is affected.

A remote user can send specially crafted data to a target application that uses the libxml UTF-8 decoding function to cause the library to enter an infinite loop.

The vulnerability resides in the xmlCurrentChar() function and can be triggered by certain multibyte combinations.

Brad Fitzpatrick of Google reported this vulnerability.

Impact:   A remote user can cause the target application to enter an infinite loop and consume excessive CPU resources on the target system.
Solution:   VMware has issued a fix.

ESX 2.5.5 Upgrade Patch 6
http://download3.vmware.com/software/esx/esx-2.5.5-78667-upgrade.tar.gz
md5sum: b4d5e98cc175a507e8f89d9c7b993e2c
http://vmware.com/support/esx25/doc/esx-255-200803-patch.html

ESX 2.5.4 Upgrade Patch 17
http://download3.vmware.com/software/esx/esx-2.5.4-78717-upgrade.tar.gz
md5sum: 827406844dacba92f695980f49119465
http://vmware.com/support/esx25/doc/esx-254-200803-patch.html

Cause:   Input validation error, State error

Message History:   This archive entry is a follow-up to the message listed below.
Jan 11 2008 Libxml2 UTF-8 Validation Flaw Lets Remote Users Deny Service



 Source Message Contents

Subject:  VMSA-2008-0006 Updated libxml2 service console package


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------
~                   VMware Security Advisory

Advisory ID:       VMSA-2008-0006
Synopsis:          Updated libxml2 service console package
Issue date:        2008-03-28
Updated on:        2008-03-28 (initial release of advisory)
CVE number:        CVE-2007-6284
- -------------------------------------------------------------------

1. Summary:

~   Updated libxml2 package addresses a security issue.

2. Relevant releases:

~   VMware ESX 2.5.5 before Upgrade Patch 6
~   VMware ESX 2.5.4 before Upgrade Patch 17


NOTE: ESX 2.5.4 is in Extended Support and its end of support (Security
and Bug fixes) is 10/08/2008.  Users should plan to upgrade to at least
2.5.5 and preferably the newest release available before the end of
extended support.

ESX Server prior to 2.5.4 are no longer in Extended Support.  Users
should upgrade to a supported version of the product.

The VMware Infrastructure Support Life Cycle Policy can be
found here:  http://www.vmware.com/support/policies/eos_vi.html


3. Problem description:

~   Updated libxml2 package to address a denial of service flaw.

~   Thanks to the Google security team for identifying and reporting
~   this issue.

~   The Common Vulnerabilities and Exposures project (cve.mitre.org)
~   has assigned the name CVE-2007-6284 to this issue.

4. Solution:

Please review the Patch notes for your product and version and verify
the md5sum of your downloaded file.

ESX 2.5.5 Upgrade Patch 6
http://download3.vmware.com/software/esx/esx-2.5.5-78667-upgrade.tar.gz
md5sum:   b4d5e98cc175a507e8f89d9c7b993e2c
http://vmware.com/support/esx25/doc/esx-255-200803-patch.html

ESX 2.5.4 Upgrade Patch 17
http://download3.vmware.com/software/esx/esx-2.5.4-78717-upgrade.tar.gz
md5sum:   827406844dacba92f695980f49119465
http://vmware.com/support/esx25/doc/esx-254-200803-patch.html

5. References:

~   CVE numbers
~   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6284

- -------------------------------------------------------------------
6. Contact:

E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

~  * security-announce@lists.vmware.com
~  * bugtraq@securityfocus.com
~  * full-disclosure@lists.grok.org.uk

E-mail:  security@vmware.com

Security web site
http://www.vmware.com/security

VMware security response policy
http://www.vmware.com/support/policies/security_response.html

General support life cycle policy
http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html

Copyright 2008 VMware Inc.  All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFH7Y4TS2KysvBH1xkRCN8OAJ0eVZsU0UdJ3Uxq13lwL8aqHNGQDgCeO6I4
GQohVVhkDGpY15oIWJudPxw=
=QvVA
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC