VMware ESX 4.0, Patch ESX400-200911232-SG: Updates curl (1014849)
Summaries and Symptoms
Issues fixed in this patch (and their relevant symptoms, if applicable) include:
- This fix includes updated cURL packages that fix security issues in the ESX service console. cURL is vulnerable to a null prefix attack, caused by incorrect handling of NULL characters in X.509 certificates. A malicious user might be able to use a signed certificate in a man-in-the-middle attack and potentially confuse cURL into accepting it. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2009-2417 to this issue.
For a complete list of the issues fixed in ESX 4.0 Update 1, see the ESX 4.0 Update 1 Release Notes.
None beyond the required patch bundles and reboot information listed in the table above.
Patch Download and Installation
See the VMware vCenter Update Manager Administration Guide for instructions on using Update Manager to download and install patches to automatically update ESX 4.0 hosts.
To update ESX 4.0 hosts when not using Update Manager, download the patch zip file from http://support.vmware.com/selfsupport/download/ and install the bulletin using esxupdate from the command line of the host. For more information, see the ESX 4 Patch Management Guide.