Knowledge Base

Summaries and Symptoms

This patch upgrades the service console RPMs for bind-utils and bind-lib to version 9.2.4-22.el3.
 
Version 9.2.4.-22.el3 addresses the recently discovered vulnerability in the BIND software used for Domain Name resolution (DNS). VMware does not install all the BIND packages on ESX and the system's default configuration is not vulnerable. Of the BIND packages, VMware only ships bind-util and bind-lib in the service console and these components by themselves cannot be used to set up a DNS server. Bind-lib and bind-util are used in client DNS applications like nsupdate, nslookup, and so on.

VMware explicitly discourages installing applications like BIND on the service console. If you have installed BIND, and the DNS server is configured to support recursive queries, your ESX system is affected and you should replace BIND with a patched version.

Note: ESX uses the DNS server on the network it is on, so it is important to patch that DNS server.

The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2008-1447 to this issue.  

Deployment Considerations

If you are using esxupdate , you must install 2nd-level dependencies before installing this patch. For details, see Patch Installation Using esxupdate Fails Because 2nd-Level Dependency Is Not Installed (KB 1007060).

Patch Download and Installation

See the VMware Update Manager Administration Guide for instructions on using Update Manager to download and install patches to automatically update ESX Server 3.5 hosts.

To update ESX Server 3.5 hosts when not using Update Manager, download the most recent patch bundle from http://support.vmware.com/selfsupport/download/ and install the bundle using esxupdate from the command line of the host. For more information, see the ESX Server 3 Patch Management Guide.