The KB articles 1164, 1165 and 1167 talk about this being fixed but they dont mention ESX 3.x which is why I am looking for an updated KB or anything else that can be presented to the FSO so that they will let the host on the network...

==========PDI=IAVA0350 Result========================

PDI Number: IAVA0350

Finding Category: CAT III

Reference: IAVA 2003-T-0020

Description: There is a buffer mismanagement vulnerability in OpenSSH prior to version 3.7.1.

Status: Open

For example:

IAVA0350: IAVA 2003-T-0020 - OpenSSH Buffer Mismanagement flaw - has

has not been applied to host.org. The OpenSSH version is 3.6.1 and

should be greater than 3.7.1p1.

==========PDI=IAVA0360 Result========================

PDI Number: IAVA0360

Finding Category: CAT I

Reference: IAVA 2003-A-0015

Description: There are multiple vulnerabilities in OpenSSL.

Status: Open

For example:

IAVA0360: IAVA 2003-A-0015

/usr/bin/openssl version 0.9.7a found on host.org 2.4.21-47.0.1.ELvmnix.

==========PDI=IAVA0410 Result========================

PDI Number: IAVA0410

Finding Category: CAT II

Reference: IAVA 2004-B-0006

Description: Detected an OpenSSL denial of service vulnerability.

Status: Open

For example:

IAVA0410: IAVA 2004-B-0006 OpenSSL denial of service - has not been.

implemented by upgrading to OpenSSL version 0.9.7d or higher.

The version on host.org is 0.9.7a.

From my searches it seems that IAVA0360 (IAVA 2003-A-0015) relates to CVE CAN-2003-0543, CAN-2003-0544, CAN-2003-0545

Searching the KB, all three CVE numbers point to this article:

1165: Security Response to BugTraq 343055: Denial of Service Attack Vulnerabilities in OpenSSL Software Used in VMware GSX Server and ESX Server
the forum wont paste the url correctly but if you search for 1165 in the KB it should be the only hit.

The article would be perfect to state that this is a false finding except that it does not directly say that it relates to ESX 3.0.x or higher....

I have read on other threads that there is soon going to be a DISA STIG for ESX but untill then I have to work with what is already out there and since we were told that this was "fixed" at VMWorld I am just trying to find the documenation to back it up...

Thanks for the help.