Knowledge Base

The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides

Search the VMware Knowledge Base (KB)

View by Article ID

VMware ESX 4.0, Patch ESX400-200911232-SG: Updates curl

Product Versions	ESX 4.0
Build	For build information, see KB 1014842.
Patch Classification	Security
Host Reboot Required	No
Virtual Machine Migration or Shutdown Required	No
PRs Fixed	449513 464036 464041 470134
Affected Hardware	N/A
Affected Software	N/A
VIBs Included	curl
Related CVE numbers	CVE-2009-2417

Issues fixed in this patch (and their relevant symptoms, if applicable) include:

This fix includes updated cURL packages that fix security issues in the ESX service console. cURL is vulnerable to a null prefix attack, caused by incorrect handling of NULL characters in X.509 certificates. A malicious user might be able to use a signed certificate in a man-in-the-middle attack and potentially confuse cURL into accepting it. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2009-2417 to this issue.

For a complete list of the issues fixed in ESX 4.0 Update 1, see the ESX 4.0 Update 1 Release Notes.

None beyond the required patch bundles and reboot information listed in the table above.

See the VMware vCenter Update Manager Administration Guide for instructions on using Update Manager to download and install patches to automatically update ESX 4.0 hosts.

To update ESX 4.0 hosts when not using Update Manager, download the patch zip file from http://support.vmware.com/selfsupport/download/ and install the bulletin using esxupdate from the command line of the host. For more information, see the ESX 4 Patch Management Guide.

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

1 2 3 4 5

1 2 3 4 5

Actions

Did this article help you?
This article resolved my issue. This article did not resolve my issue. This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (4000 or fewer characters)