VMware ESX 4.0, Patch ESX400-Update01
From the release notes:

VMware View 4.0 support – This release adds support for VMware View 4.0, a solution built specifically for delivering desktops as a managed service from the protocol to the platform.

Windows 7 and Windows 2008 R2 support –This release adds support for 32-bit and 64-bit versions of Windows 7 as well as 64-bit Windows 2008 R2 as guest OS platforms. In addition, the vSphere Client is now supported and can be installed on a Windows 7 platform. For a complete list of supported guest operating systems with this release, see the VMware Compatibility Guide.

Enhanced Clustering Support for Microsoft Windows – Microsoft Cluster Server (MSCS) for Windows 2000 and 2003 and Windows Server 2008 Failover Clustering is now supported on an VMware High Availability (HA) and Dynamic Resource Scheduler (DRS) cluster in a limited configuration. HA and DRS functionality can be effectively disabled for individual MSCS virtual machines as opposed to disabling HA and DRS on the entire ESX/ESXi host.

Enhanced VMware Paravirtualized SCSI Support – Support for boot disk devices attached to a Paravirtualized SCSI ( PVSCSI) adapter has been added for Windows 2003 and 2008 guest operating systems. Floppy disk images are also available containing the driver for use during the Windows installation by selecting F6 to install additional drivers during setup. Floppy images can be found in the /vmimages/floppies/ folder.

Improved vNetwork Distributed Switch Performance – Several performance and usability issues have been resolved resulting in the following:

Improved performance when making configuration changes to a vNetwork Distributed Switch (vDS) instance when the ESX/ESXi host is under a heavy load
Improved performance when adding or removing an ESX/ESXi host to or from a vDS instance

Increase in vCPU per Core Limit – The limit on vCPUs per core has been increased from 20 to 25. This change raises the supported limit only. It does not include any additional performance optimizations. Raising the limit allows users more flexibility to configure systems based on specific workloads and to get the most advantage from increasingly faster processors. The achievable number of vCPUs per core depends on the workload and specifics of the hardware.

Enablement of Intel Xeon Processor 3400 Series – Support for the Xeon processor 3400 series has been added.

ESX 4.0 Update 1 requires a host reboot and VM shutdown.

Note that several of the upgrade methods that were available with past ESX editions are not available. These include the GUI or text mode upgrade from CD, scripted upgrade from CD or PXE boot and upgrade with a tarball via the service console. Only the vSphere Host Update Utility and VMware Update Manager are supported for performing upgrades from ESX 3.x to ESX 4.0 Update 1

Cisco Nexus 1000v
VEM-4.0.0-update01-v100

VMware vCenter 4.0 Update 1
From the release notes:

This update release of VMware vCenter Server 4.0 Update 1 offers the following improvements:

IBM DB2 Database Support for vCenter Server — This release adds support for IBM DB2 9.5 as the backend database platform for VMware vCenter Server 4.0. The following editions of IBM DB2 are supported:

• IBM DB2 Enterprise 9.5
• IBM DB2 Workgroup 9.5
• IBM DB2 Express 9.5
• IBM DB2 Express-C 9.5

VMware View 4.0 support — This release adds support for VMware View 4.0, a solution built specifically for delivering desktops as a managed service from the protocol to the platform.
Windows 7 and Windows 2008 R2 support — This release adds support for 32-bit and 64-bit versions of Windows 7 as well as 64-bit Windows 2008 R2 as guest operating system platforms. In addition, the vSphere Client is now supported and can be installed on a Windows 7 platform.
Pre-Upgrade Checker Tool — A standalone pre-upgrade checker tool is now available as part of the vCenter Server installation media that proactively checks ESX hosts for any potential issues that you might encounter while upgrading vCenter agents on these hosts as part of the vCenter Server upgrade process. You can run this tool independently prior to upgrading an existing vCenter Server instance. The tool can help identify any configuration, networking, disk space or other ESX host-related issues that could prevent ESX hosts from being managed by vCenter Server after a successful vCenter Server upgrade.
HA Cluster Configuration Maximum — HA clusters can now support 160 virtual machines per host in HA Cluster of 8 hosts or less. The maximum number of virtual machines per host in cluster sizes of 9 hosts and above is still 40, allowing a maximum of 1280 Virtual Machines per HA cluster.

vCenter Server 4.0 Update 1 includes updates to VMware Converter Enterprise, VMware Update Manager, VMware Guided Consolidation and VMware Orchestrator

VMware Data Recovery 1.1

The following enhancements are included in Data Recovery 1.1

File Level Restore Functionality is Officially Supported
File Level Restore (FLR) provides a way to access individual files within restore points for Windows virtual machines. In previous versions of Data Recovery, FLR was provided as an experimental feature. File Level Restore feature is now officially supported.

Integrity Check Stability and Performance Improved
The integrity check process is faster and more stable. Note that integrity checks are computationally intensive processes and can take significant periods of time. The exact amount of time integrity checks take varies based on of the size of the deduplication store. Even with these enhancements, integrity checks that take several hours are not unexpected.

Integrity Checks Provides Improved Progress Information
When an integrity check is running, a progress indicator is displayed. This progress indicator has been improved, although it does not provide the optimal level of detail.

Enhanced CIFS Shares Support

Patches are available on the downloads page.
One of the locations that VMware lists updates is on the VMware Knowledge Base Blog.

Today, I had the good fortune to work with Todd Dayton, A VMware specialist on all things VDI/View related. The client I am working for had been accepted into the View 4 beta and Todd was onsite to help with the install and config of View and some thin clients.
We relearned a pretty common lesson in IT that a clean install is generally better than an upgrade. In an effort to save a few minutes, we decided to upgrade existing View 3 components. The connection server worked well, and the View composer worked, but the View 3 agent and the VMware tools from ESX 3.5 caused us to have problems with PCoIP connections. After removing the new agent, then removing the old VMware tools, we reinstalled the VMware tools for ESX 4 and finally the View 4 agent. After this remediation things worked like a charm!
If you haven’t tried PCoIP, you must! It blows the doors off RDP. I can’t wait to get the released bits and get this into production. Thanks Todd for the assistance!

This week VMware posted KB article 1010839 on licensing ESX 4, ESXi 4 and vCenter 4. I get many questions in class about the new license assignment process for vSphere. This KB article has a nice video demonstration and very concise text direction for assigning licenses.

Earlier today I saw an exchange between Scott Lowe and Chad Sakac on twitter regarding a post on learning about EMC storage. I teach as a contractor for VMware and storage is routinely identified by students a topic for more and more in-depth discussion. I follow both Scott Lowe’s and Chad Sakac’s blogs with interest as they both have provided me with insight and very useful information. In this case, I found the comments to be very helpful and in particular the comment from Chad Sakac of EMC to be a succinct and helpful quick start for learning more about EMC storage and VMware and will be referencing it in future classes.

Sitting in the VCI session at VMworld, I received an e-mail containing the following:

Congratulations! You have successfully passed the VMware Certified Professional beta exam on vSphere4 (VCP4).

It took about 6 weeks to get that message. I am happy to be done with that test!

Now back to the vSphere networking presentation…

VMware released vCenter 2.5 Update 5. The release notes state:

VirtualCenter 2.5 Update 5 includes significant performance and scalability improvements to VMware HA. Use VirtualCenter 2.5 Update 5 for environments with more than 35 virtual machines per host in an HA cluster.
For information on the ESX Server host settings required for this scalability improvement, see ESX Server host settings required for environments with up to 80 virtual machines per host in an HA Cluster (KB 1012002).

KB 1012002 states that with vCenter 2.5 update 5 an ESX host in an HA cluster can support up to 80 VM’s. The article continues with the specific ESX settings that are needed. The “RunningVCpuLimit” needs to be set to 192, the Service Console memory needs to be raised to 512MB and the Host Agent (hostd) memory settings in /etc/vmware/hostd/config.xml need to be increased. Note that the ESX host will need to be restarted after changing the Service Consle memory allocation.

In addition to the HA change, the release adds new http connection timeout settings:

A new advanced setting entry vpxd.httpClientIdleTimeout can be used to configure the timeout value for an idle HTTP connection. The default value for this entry is 15 minutes (900 seconds), ensuring that the VirtualCenter Server closes the idle HTTP connection after the connection has been idle for 15 minutes. If a firewall session timeout value is set to less than 15 minutes, the value for vpxd.httpClientIdleTimeout should be changed to be smaller than the firewall’s timeout value.

No updates to the vCenter Enterprise Converter or Update Manager plug-ins have been made.

VMware released 7 patches for ESX 3.5 including:

VMware ESX 3.5, Patch ESX350-200906401-BG : Updates vmkctl and vmkernel RPMs

Issues fixed in this patch (and their relevant symptoms, if applicable) include:

When you power on virtual machines on ESX 3.5 hosts, many inactive VMFS volumes are opened in addition to the VMFS volume containing the virtual machine disk files. This might cause the virtual machines to take more time to boot. In a cluster environment, this issue might also cause VMotion operations to timeout on the destination host. This fix ensures that only the VMFS volumes on which the virtual machines reside are opened.

While performing a host rescan on ESXi, the host and virtual machines might stop responding till the end of the rescan operation. During this time, connections to virtual machines are lost, including SSH, client connections, and communication to other clustered storage modules. The virtual machines start responding after the rescan operation is completed.

Excessive cold migration of virtual machines between ESX hosts might cause ESX hosts to be disconnected from vCenter Server due to a memory leak on the host agent (hostd).

Critical update. Host reboot required.

VMware ESX 3.5, Patch ESX350-200906402-BG: Updates NetXen Driver

This patch fixes a NetXen driver issue where the ESX 3.5 host or a virtual machine might lose network connectivity or become unstable when using a NetXen NX2031 device.

Critical Update. Host reboot required.

VMware ESX 3.5, Patch ESX350-200906403-BG: Updates Kernel Source and kernel-vmnix RPMs

This patch upgrades kernel-source and kernel-vmnix to support the bnx2x and NetXen software driver updates, which fix the following issues:

When virtual machines are run with older versions of VMware Tools (ESX 3.0.x) on ESX 3.5 and ESXi 3.5 hosts containing bnx2x NICs, the virtual machines might experience a network outage…
To work around this issue, upgrade the version of VMware Tools in the virtual machines.

A NetXen driver issue where the ESX 3.5 host or a virtual machine might lose network connectivity or become unstable when using a NetXen NX2031 device.

General Patch. Host reboot required.

VMware ESX 3.5, Patch ESX350-200906405-BG: Updates bnx2x Driver for Broadcom

Issues fixed in this patch (and their relevant symptoms, if applicable) include:

On Dell PowerEdgeServers 11G installed with ESX 3.5, BCM57710 Mezzanine cards might lose network connectivity to the network switch.

When virtual machines are run with older versions of VMware Tools (ESX 3.0.x) on ESX 3.5 and ESXi 3.5 hosts containing bnx2x NICs, the virtual machines might experience a network outage…

To work around this issue, upgrade the version of VMware Tools in the virtual machines.

Critical Patch. Host reboot required.

VMware ESX 3.5, Patch ESX350-200906406-BG:Updates VMware Tools

This patch adds prebuilt modules for Ubuntu 9.04 and fixes the following issue:
When diskinfo query is run, VMware Tools installed on Solaris 10.x virtual machines reports incorrect virtual disk size information. Also, some Linux virtual machines do not report correct logical volume manager (LVM) partitions.

General Update. No host reboot is required.

VMware ESX 3.5, Patch ESX350-200906407-BG: Updates krb5-libs and pam_krb5

Issues fixed in this patch (and their relevant symptoms, if applicable) include:

Service Console package krb5 has been updated to version krb5-1.2.7-70. This fixes a input validation flaw that was found in the ASN.1 (Abstract Syntax Notation One) decoder used by MIT Kerberos. The Common Vulnerabilities and Exposures Project has assigned the name CVE-2009-0846 to this issue.

The pam_krb5 package is upgraded to pam_krb5-1.81-1. This fixes an issue where a user authentication failure occurs under certain circumstances.
For details on this issue, refer to the Red Hat advisory at https://rhn.redhat.com/errata/RHBA-2008-0813.html.

Security Update. Host Reboot is required.

VMware ESX 3.5, Patch ESX350-200906408-BG: Updates VMX RPM

This patch fixes an issue where virtual machines that use the Virtual Machine Interface (VMI) might stop responding.

Critical Update. No host reboot is required.

Patches are available on the downloads page.
One of the locations that VMware lists updates is on the VMware Knowledge Base Blog.

I have added a page for links to Citrix/Terminal Services related items. You can get there from here.

Network Segmentation in Virtualized Environments

As virtualization becomes the standard infrastructure for server deployments, a growing number of organizations want to consolidate servers that belong to different trust zones. The demand is increasing for information to help network security professionals understand and mitigate the risks associated with this practice. This paper provides detailed descriptions of three different virtualized trust zone configurations and identifies best practice approaches that enable secure deployment.

DMZ Virtualization Using VMware vSphere 4 and the Cisco Nexus 1000V Virtual Switch

This paper tackles the subject of DMZ security and virtualization. It covers a number of DMZ security requirements and scenarios, presenting how vSphere users can implement the Cisco Nexus 1000V virtual switch in a DMZ.

VMware has released security advisory VMSA-2009-0008. The advisory is for a vulnerability in an MIT Kerberos 5 package in the service console. The advisory explains:

An input validation flaw in the asn1_decode_generaltime function in MIT Kerberos 5 before 1.6.4 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer. A remote attacker could use this flaw to crash a network service using the MIT Kerberos library, such as kadmind or krb5kdc, by causing it to dereference or free an uninitialized pointer or, possibly, execute arbitrary code with the privileges of the user running the service.
NOTE: ESX by default is unaffected by this issue, the daemons kadmind and krb5kdc are not installed in ESX.

The advisory goes on to state that all currently supported version of ESX (not ESXi) are affected.
For ESX 3.5 the patch: ESX 3.5.0 ESX350-200906407-SG
md5sum: 6b8079430b0958abbf77e944a677ac6b
KB Article: VMware ESX 3.5, Patch ESX350-200906407-BG: Updates krb5-libs and pam_krb5

For ESX 2.5.5, 3.0.2, 3.0.3 and 4.0 patches are pending.

You can subscribe to VMware Security announcments here: http://lists.vmware.com/mailman/listinfo/security-announce