Knowledge Base

Summaries and Symptoms

This patch updates the NTP package to ntp-4.1.2-6.el3, which fixes two security issues in the ESX service console.

• A flaw in the way NTP daemon handled certain malformed NTP packets. Information on all such packets were logged and responded with an NTP packet that was treated as malformed when received by another ntpd. A remote attacker might use this issue to cause excessive CPU and bandwidth consumption.
  The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2009-3563 to this issue.
• A buffer overflow flaw that was found in the ntpq diagnostic command that might allow a remote server to send a reply to an ntpq request, where the ntpq command might fail, or potentially, allow execution of arbitrary code with the privileges of the user running the ntpq command.
  The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2009-0159 to this issue.

Deployment Considerations

None beyond the required patch bundles and reboot information listed in the table, above.

Patch Download and Installation

See the vCenter Update Manager Administration Guide for instructions on using Update Manager to download and install patches to automatically update ESX 3.5 hosts.

To update ESX 3.5 hosts without using Update Manager, download the most recent patch bundle from http://www.vmware.com/download/vi/vi3_patches_35.html and install the bundle using esxupdate from the command line of the host. For more information, see the ESX Server 3 Patch Management Guide.