VMware ESX Server 3.5, Patch ESX350-200802305-SG: Security Update to the OpenSSL Package

Release Date: 3/10/08
Document Last Updated: 3/10/08

Summary

This patch provides updates to the OpenSSL package distributed with the service console for ESX Server 3.5. The patch adresses the following security issues:

• A flaw in the SSL_get_shared_ciphers() function can allow an attacker to cause a buffer overflow problem by sending ciphers to applications that use the function.
  
  
• A possibile vulnerability that might allow a local attacker to obtain private RSA keys being used on a system using the OpenSSL package.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2007-3108 and CVE-2007-5135 to these issues.

Note: These issues only affect the service console network, and are not remote vulnerabilities for ESX Server hosts that have been set up with the security best practices provided by VMware. See http://www.vmware.com/resources/techresources/726 for more information on security best practices.