VMware Server Version 1.0.5 (free) / http://www.vmware.com/download/server

• A security vulnerability in OpenSSL 0.9.7j could make it possible to forge a RSA key signature. VMware Server 1.0.5 upgrades OpenSSL to version 0.9.7l to avoid this vulnerability.
• An internal security audit determined that a malicious user could attain and exploit LocalSystem privileges by causing the authd process to connect to a named pipe that is opened and controlled by the
• malicious user. In this situation, the malicious user could successfully impersonate authd and attain privileges under which authd is executing.
• An internal security audit determined that a malicious user could exploit an insecurely created named pipe object to escalate priviliges or create a denial-of-service attack.
• This release updates the libpng library to version 1.2.22 to remove various security vulnerabilities.
• A vulnerability in VMware Workstation running on Windows allowed complete access to the host's file system from a guest machine. This access included the ability to create and modify executable files in
  sensitive locations.
• The authd process read and honored the vmx.fullpath variable in the user-writable file config.ini, creating a security vulnerability.
• The config.ini file could be modified by non-administrator to change the VMX launch path. This created a vulnerability that could be exploited to escalate a user's privileges.

• On Windows hosts, if you have configured and enabled a shared folder, it is possible for an attacker to write arbitrary content from a guest system to arbitrary locations on the host system.
• An internal security audit determined that a malicious user could attain and exploit LocalSystem privileges by causing the authd process to connect to a named pipe that is opened and controlled by the malicious user. In this situation, the malicious user could successfully impersonate authd and attain privileges under which Authd is executing.
• This release updates the libpng library to version 1.2.22 to remove various security vulnerabilities.
• This release updates the OpenSSL library to address various vulnerabilities to denial-of-service attacks and buffer overflows.
• Workstation 6.0.2 allowed anonymous console access to the guest by means of the VIX API. This release, Workstation 6.0.3, disables this feature. This means that the Eclipse Integrated Virtual Debugger and the Visual Studio Integrated Virtual Debugger will now prompt for user account credentials to access a guest.

• On Windows hosts, if you have configured and enabled a shared folder, it is possible for an attacker to write arbitrary content from a guest system to arbitrary locations on the host system.
• Ubuntu 7.04 virtual machines sometimes power off unexpectedly if paravirtual kernel support is enabled.

• Release Notes: http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html#new_203

• http://www.vmware.com/beta/server

This is a new section that I am going to try to write every week. It will
have the links or articles that called my attention the most in the last 7 days, so you can have
them too. Here we go:

1. Cheap Hypervisors: A Fine Idea -- If You Can Afford Them via
   VMware: Virtual Reality (the comments are also very interesting)
2. The Complete Clustering How-To Presentation (VMworld 2007) via Jumé BV
3. Managing IT Projects via Life as a Healthcare CIO
4. Windows Server 2008 Step-by-Step Guides
5. Webcast: Hardening Windows Server 2008 and its guide

I have been using mRemote for two months now and I mainly like it because:

1) It supports rdp, vnc, ssh, telent, rlogin, raw, http/s and ica, so you can check your web sites, connect to the ESX Server / Unix farm and manage your Microsoft Infrastructure through RDP using only one window





2) It will recognize your Putty sessions

3) mRemote can call external applications and tell them what to do with the use of parameters and variables of the currently selected connection

Give it a try and hopefully you will like it too!

Download mRemote at Sourceforge (1)

(1) Be sure to have the .Net Framework installed in advance

Posted by Gabriel Maciel

Here you have some of the links I came across recently and wanted to share in the Blog:

Veeam Backup
A groundbreaking disaster recovery solution for VMware Infrastructure 3 that combines backup and replication in one product.

Virtual Center 2.5 Passthrough Authentication via www.vinternals.com
"At last! VMware have finally added passthrough auth support in VC 2.5, although it is currently classed as experimental. This is something I have been waiting / asking about for quite some time. And even better, it's on by default! To use it, simply add -passthroughAuth -s vchostname to the end of the shortcut used to launch the VI 2.5 client."

Add multiple SCSI controllers to your VM to improve performance via www.yellow-bricks.com
"A couple of months ago at the Dutch VMug meeting Bouke-Jumé gave some good storage tips. This is one of them:
The LSI Bus Logic Controller / Driver has a standard queue depth of 256. Although it isn't possible to set this higher it is possible to add a second controller and when you make sure the SCSI ID of your disk corresponds to the SCSI card you will have another queue of 256. This can lead to improved performance for Database Servers, Files Servers and other I/O intensive VM's."

Dominic Rivera's Esx-AutoPatch.pl now supports ESX 3.5.0
"I've had a number of visitors write in to inquire about esx-autopatch.pl, and when I would update the script to support ESX 3.5.0. To be honest I didn't really plan to update the script since VMware's Update Manger seems to be doing an adequate job of filling that need. But if you need to get the patches installed at build time, or don't have Virtual Center at your disposal I still believe esx-autopatch.pl is the best answer out there."

Posted By Gabriel Maciel

Mike Laverick recently gave a really interesting 42 minutes Webcast covering the following topics:

1) ESX Partitioning
2) Local VMFS Volumes
3) Pros & Cons of using SAN Storage
4) How big should my LUNs be?
5) How big should my Virtual Disk be?
6) How should you arrange Virtual Disks in VM?
7) What are the storage considerations for VDI?
8) What storage considerations do you have with VMware Virtual Machine Snapshots?
9) Storage Monitoring / Reporting advices
10) How fast will my Virtual Center Data Base grow?

You can watch the event here.

Posted by Gabriel Maciel

Forbes Guthrie has released a reference card for the VMware 3 / 3.5 environment. It covers the ESX Install, 3i, Storage, Networking, MSCS Clustering, Resources, Backups, ESX Host, VMs, Web Access, Virtual Center and License Server.

You can can find your copy here.

Posted By Gabriel Maciel

If you are interested in taking a web based training that will explain you the basics about Storage Area Networks, go to this Hewlett Packard site and register / login for free. The course is not bad at all and can be used to refresh your knowledge or learn something new. Enjoy!

Posted By Gabriel Maciel