VMSA-2008-0003 : Moderate: Updated aacraid driver and samba and python Service Console updates

This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.


Synopsis :

The remote VMware ESX host is missing one or more security-related
patches.

Description :

I Updated ESX driver

a. Updated aacraid driver

This patch fixes a flaw in how the aacraid SCSI driver checked
IOCTL command permissions. This flaw might allow a local user
on the Service Console to cause a denial of service or gain
privileges. Thanks to Adaptec for reporting this issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2007-4308 to this issue.

II Service Console package security updates

a. Samba

Alin Rad Pop of Secunia Research found a stack-based buffer overflow
flaw in the way Samba authenticates remote users. A remote
unauthenticated user could trigger this flaw to cause the Samba
server to crash or to execute arbitrary code with the
permissions of the Samba server.

Note: This vulnerability can be exploited only if the attacker
has access to the Service Console network. The Samba
client is installed by default in the Service Console, but
the Samba server is not.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2007-6015 to this issue.

b. Python

Chris Evans of the Google security research team discovered an
integer overflow issue with the way Python's Perl-Compatible
Regular Expression (PCRE) module handled certain regular
expressions. If a Python application used the PCRE module to
compile and execute untrusted regular expressions, it might be
possible to cause the application to crash, or to execute
arbitrary code with the privileges of the Python interpreter.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2006-7228 to this issue.

Piotr Engelking discovered a flaw in Python's locale module
where strings generated by the strxfrm() function were not
properly NUL-terminated. This might result in disclosure of
data stored in the memory of a Python application using the
strxfrm() function.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2007-2052 to this issue.

Slythers Bro reported multiple integer overflow flaws in
Python's imageop module. These could allow an attacker to cause
a Python application to crash, enter an infinite loop, or
possibly execute arbitrary code with the privileges of the
Python interpreter.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2007-4965 to this issue.

See also :

http://lists.vmware.com/pipermail/security-announce/2008/000012.html

Solution :

Apply the missing patches.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.3
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true

Family: VMware ESX Local Security Checks

Nessus Plugin ID: 40374 ()

Bugtraq ID: 23887
25216
25696
26727
26791

CVE ID: CVE-2006-7228
CVE-2007-2052
CVE-2007-4308
CVE-2007-4965
CVE-2007-6015