VMware
 

Knowledge Base

Search the Knowledge Base:
Products:
Search In:
 

Security Response to CAN-2004-1235: Audit Warns of Possible Vulnerability in the uselib Function in the 2.4 Linux Kernel

Details

A security software audit warns that an ESX Server machine may have the security vulnerability described at:

cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1235.

How can I protect the server? Does VMware have a fix for this?

Solution

This vulnerability affects Linux 2.4 kernels in general. It applies to ESX Server because the VMware Service Console is based on the Linux 2.4 kernel.

Certain functions in the uselib library do not handle VMA descriptors correctly, possibly allowing an unauthorized user to gain superuser priviledges. VMware includes updates to repair this vulnerability for ESX Server 2.1.x and 2.0.x in the following upgrade patches:

For ESX Server 2.5, you can repair this vulnerability by upgrading to VMware ESX Server 2.5.1.

Keywords

1654; urlz; alertz; CAN-2004-1235

Feedback

Rating: 1 - Lowest 2 3 4 5 - Highest (0 Ratings)   

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (2000 or fewer characters)
Submit
Rating: 1 - Lowest 2 3 4 5 - Highest (0 Ratings)   
Actions
  • KB Article: 1654
  • Updated: Aug 14, 2009
  • Products:
    VMware ESX
  • Product Versions:
    VMware ESX 2.0.x
    VMware ESX 2.1.x
    VMware ESX 2.5.x