Knowledge Base

The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides
 
Search the VMware Knowledge Base (KB)   View by Article ID
 

VMware ESXi 5.1 Patch Image Profile ESXi-5.1.0-20140101001s-no-tools (2062313)

Details

Release date: January 16, 2014

Profile Name
ESXi-5.1.0-20140101001s-no-tools
Build
For build information, see KB 2062314.
Vendor
VMware, Inc.
Release Date
January 16, 2014
Acceptance Level
PartnerSupported
Affected Hardware
N/A
Affected Software
N/A
Affected VIBs
esx-base, esx-xlibs, esx-xserver
PRs Fixed
989832, 1020120, 1052758, 1139318, 915614, 1054557
Related CVE numbers
CVE-2013-0169, CVE-2013-0166, CVE-2014-1207, CVE-2014-1208

For more information on patch and update classification, see KB 2014447.


Solution

Summaries and Symptoms

This patch updates the esx-base, esx-xlibs, and esx-xserver VIBs to resolve the following issues:

  • PR 989832: The ESXi userworld OpenSSL library is updated to version openssl-0.9.8y to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assignedthe names CVE-2013-0169 and CVE-2013-0166.

  • PR 1020120: During the remediation process of an ESXi host against a patch baseline, which consists of bulletins that have only Reboot impact, Update Manager fails to power off or suspend the virtual machines that are on the host. As a result the host cannot enter maintenance mode, and the remediation cannot be completed. This issue is resolved in bulletins created in this release and later.

  • PR 1052758: VMware ESXi and ESX contain a NULL pointer dereference in the handling of the Network File Copy (NFC) traffic. To exploit this vulnerability, an attacker must intercept and modify the NFC traffic between ESXi/ESX and the client. Exploitation of the issue may lead to a Denial of Service. The Common Vulnerabilities and Exposures project cve.mitre.org) has assigned the name CVE-2014-1207 to this issue.

  • PR 915614: Due to a flaw in the handling of invalid ports, it is possible to cause the VMX process to fail. This vulnerability may allow a guest user to crash the VMX process resulting in a partial denial of service on the host. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-1208 to this issue.

  • PR 1054557: This patch updates the esx-libs and esx-xserver VIBs to resolve a stability issue.

Deployment Considerations

None beyond the required patch bundles and reboot information listed in the table above.

Patch Download and Installation

An ESXi system can be updated using the image profile, by using the esxcli software profile command. For details, see the vSphere Command-Line Interface Concepts and Examples and the vSphere Upgrade Guide. For information about image profiles and how it applies to ESXi 5.1 hosts, see Image Profiles of ESXi 5.x Hosts (KB 2009231). ESXi hosts can also be updated by manually downloading the patch ZIP file from the VMware download page and installing the VIB by using the esxcli software vib command.

Additional Information

For translated versions of this article, see:

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 1 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (4000 or fewer characters)
  • 1 Ratings
Actions
KB: