VARIoT IoT vulnerabilities database

VAR-201004-0153 | CVE-2010-0589 | CSD of Web Install ActiveX Vulnerabilities that could force the download and execution of arbitrary files in Control |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
The Web Install ActiveX control (CSDWebInstaller) in Cisco Secure Desktop (CSD) before 3.5.841 does not properly verify the signatures of downloaded programs, which allows remote attackers to force the download and execution of arbitrary files via a crafted web page, aka Bug ID CSCta25876. This vulnerability allows remote attackers to execute arbitrary code on systems with vulnerable installations of Cisco Secure Desktop. The control fails to properly verify the signature of the downloaded executable being installed. By not verifying the executable a malicious attacker can force the user to download and run any code of their choosing. Successful exploitation leads to full system compromise under the credentials of the currently logged in user.
Attackers may exploit this issue to put malicious files in arbitrary locations on a victim's computer.
This issue is being tracked by Cisco Bug ID CSCta25876. Cisco Secure Desktop (CSD) is a secure desktop product of Cisco (Cisco), which can reduce the number of cookies, browser history, temporary files and downloads in the system after remote user logout or SSL VPN session timeout through encryption function. remaining risks.
-- Vendor Response:
Cisco has issued an update to correct this vulnerability. More
details can be found at:
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b25d01.shtml
-- Disclosure Timeline:
2009-02-24 - Vulnerability reported to vendor
2010-04-14 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Anonymous
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi.
The vulnerability is reported in versions prior to 3.5.841.
SOLUTION:
Update to version 3.5.841 or later.
PROVIDED AND/OR DISCOVERED BY:
An anonymous person, reported via ZDI.
ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20100414-csd.shtml
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-072/
OTHER REFERENCES:
Cisco:
http://www.cisco.com/warp/public/707/cisco-amb-20100414-csd.shtml
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201004-0342 | CVE-2010-1329 | Imperva SecureSphere of Web Application Firewall and Database Firewall In intrusion-prevention Vulnerability that bypasses functionality |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Imperva SecureSphere Web Application Firewall and Database Firewall 5.0.0.5082 through 7.0.0.7078 allow remote attackers to bypass intrusion-prevention functionality via a request that has an appended long string containing an unspecified manipulation.
An attacker can exploit this issue to bypass firewall restrictions. Successful exploits may lead to other attacks. The Imperva SecureSphere Database Firewall
monitors and proactively protects databases from internal abuse,
database attacks, and unauthorized activity. Protection provided by the Imperva device against attacks
such as SQL injection and Cross-Site Scripting is negated, allowing
unfiltered requests through to protected applications.
SEVERITY RATING
===============
Rating: High Risk - CVSS 7.8 (AV:N/AC:L/Au:N/C:N/I:C/A:N)
Impact: Bypass security control
Where: Remote
THREAT EVALUATION
=================
An attacker can use this flaw to bypass firewall protections. Only minimal skill is
required and the bypass can be incorporated into existing exploitation
frameworks and security testing tools. Exploitation of this issue does
not permanently affect the device; each evasion request must contain
the bypass payload.
IDENTIFYING VULNERABLE INSTALLATIONS
====================================
Administrators can identify the current version in use by going to the
Licensing menu in the administration console. Versions less than those
identified in the Solutions section below are vulnerable.
DETECTING EXPLOITATION
======================
The Imperva device provides no indication when this vulnerability is
exploited. If other controls are in place such as network traffic
monitors, IDS/IPS, or web filters, these should be configured to alert
on payloads containing attack patterns. This includes all versions of
SecureSphere from 5.0 through 7.0.
SOLUTION
========
The vendor has released patches for affected versions to address this
issue. Customers are strongly encouraged to apply the update as soon
as possible. Refer to
http://www.imperva.com/resources/adc/adc_advisories_response_clearskies.html
for upgrade instructions. No reliable workaround is available.
The vendor has provided the following version and patch data:
Version Patch Number
7.0.0.7078 Patch 11
7.0.0.7061 Patch 11
6.2.0.6463 Patch 24
6.2.0.6442 Patch 24
6.0.6.6302 Patch 30
6.0.6.6274 Patch 30
6.0.5.6238 Patch 30
6.0.5.6230 Patch 30
6.0.4.6128 Patch 30
5.0.0.5082 Patch 30
6.0.4.6128 on XOS 8.0/5 ssgw-6128-CBI10
7.0.0.7078 on XOS 8.5.3 ssgw-7.0.0.7267-CBI28
VULNERABILITY ID
================
CVE-2010-1329
TIME TABLE
==========
2009-08-31 - Vendor notified.
2010-03-09 - Vendor released patched firmware.
2010-04-05 - Public notification
REFERENCES
==========
http://www.clearskies.net/documents/css-advisory-css1001-imperva.php
http://www.imperva.com/resources/adc/adc_advisories_response_clearskies.html
CREDITS
=======
Scott Miles and Greag Johnson, Clear Skies Security, identified this
flaw.
Clear Skies would like to thank Mike Sanders and Accuvant Labs for
their assistance in clarifying and working with the vendor to correct
this issue.
LEGAL NOTICES
=============
Disclaimer: The information in the advisory is believed to be
accurate at the time of publishing and is subject to change without
notice. Use of the information constitutes acceptance for use in an
AS IS condition. There are no warranties with regard to this
information. The author is not liable for any direct, indirect, or
consequential loss or damage arising from use of, or reliance on,
this information.
Copyright 2010 Clear Skies Security, LLC.
Permission is granted for the redistribution of this alert
electronically. To reprint this alert, in whole or in part, in any
other medium other than electronically, please e-mail info (at)
clearskies (dot) net for permission
VAR-201004-0610 | No CVE | Iomega Home Media Network Hard Drive 'smbwebclient.php' Authentication Bypass Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Iomega Home Media Network Hard Drive is prone to an authentication-bypass vulnerability.
Attackers can leverage this issue to gain full browser-based read/write access to any visible shares on the device itself or the rest of the device's local network without proper authentication. Successful exploits may lead to other attacks.
This issue affects the Iomega Home Media Network Hard Drive Firmware versions 2.038 - 2.061.
VAR-201004-0218 | CVE-2010-0896 | Oracle Sun Product Suite of Sun Convergence Component vulnerabilities |
CVSS V2: 7.1 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in the Sun Convergence component in Oracle Sun Product Suite 1.0 allows remote attackers to affect confidentiality via unknown vectors related to Address Book and Mail Filter. Sun Convergence is an interactive web communication client that provides integrated access to email, calendar, contacts, online presence and chat services. No detailed vulnerability details are currently available. This vulnerability can be exploited through the 'HTTP' protocol.
This vulnerability affects the following supported versions:
1.0.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Technical Cyber Security Alert TA10-103B
Oracle Updates for Multiple Vulnerabilities
Original release date: April 13, 2010
Last revised: --
Source: US-CERT
Systems Affected
* Oracle Database 11g, versions 11.1.0.7 and 11.2.0.1
* Oracle Database 10g Release 2, versions 10.2.0.3 and 10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8 and 9.2.0.8DV
* Oracle Application Server 10gR2, version 10.1.2.3.0
* Oracle Identity Management 10g, version 10.1.4.0.1 and 10.1.4.3
* Oracle Collaboration Suite 10g, version 10.1.2.4
* Oracle E-Business Suite Release 12, versions 12.0.4, 12.0.5, 12.0.6, 12.1.1 and 12.1.2
* Oracle E-Business Suite Release 11i, versions 11.5.10 and 11.5.10.2
* Oracle Transportation Manager, versions 5.5.05.07, 5.5.06.00, and 6.0.03
* Oracle Agile - Engineering Data Management, version 6.1.1.0
* PeopleSoft Enterprise PeopleTools, versions 8.49 and 8.50
* Oracle Communications Unified Inventory Management version 7.1
* Oracle Clinical Remote Data Capture Option versions 4.5.3 and 4.6
* Oracle Thesaurus Management System versions 4.5.2, 4.6 and 4.6.1
* Oracle Retail Markdown Optimization version 13.1
* Oracle Retail Place In-Season version 12.2
* Oracle Retail Plan In-Season version 12.2
* Oracle Sun Products Suite
Overview
The Oracle products and components listed above are affected by
multiple vulnerabilities. The impacts of these vulnerabilities
include remote execution of arbitrary code, information disclosure,
and denial of service.
I. Description
The Oracle Critical Patch Update Advisory - April 2010 addresses 47
vulnerabilities in various Oracle products and components,
including 16 vulnerabilities in Sun Solaris. The Advisory provides
information about affected components, access and authorization
required for successful exploitation, and the impact from the
vulnerabilities on data confidentiality, integrity, and
availability.
Oracle has associated CVE identifiers with the vulnerabilities
addressed in this Critical Patch Update.
II. Impact
The impact of these vulnerabilities varies depending on the
product, component, and configuration of the system. Potential
consequences include the execution of arbitrary code or commands,
information disclosure, and denial of service. Vulnerable
components may be available to unauthenticated, remote attackers.
An attacker who compromises an Oracle database may be able to
access sensitive information.
III. Solution
Apply the appropriate patches or upgrade as specified in the Oracle
Critical Patch Update Advisory - April 2010. Note that this
document only lists newly corrected issues. Updates to patches for
previously known issues are not listed.
IV. References
* Oracle Critical Patch Update Advisory - April 2010 -
<http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html>
* Sun Security Blog - <http://blogs.sun.com/security/>
* Sun Product Alerts related to April 2010 CPU -
<http://search.sun.com/main/index.jsp?nh=100&rf=1&dedupe=false&reslang=en&col=main-support-sunalerts&optstat=true&qt=This+publication+relates+to+the+CPU+for+April+2010>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA10-103B.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA10-103B Feedback VU#591801" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
April 13, 2010: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBS8TsTz6pPKYJORa3AQLfYgf/VmfoGA7YXur4adESvwQhh/sssh0SEt3S
OCs9vFecRb/SuBrYtlUVSuHQdkkeoNdJ62ByNi4NY1kRF0v/tFtr2la2cRcIpxJ/
XIMFpl5lx628iEtXwnemHpm+0BGc9j+rRwIQV/oDKP57629x7jZkiVwj53WIv8tR
M8ktq9kjzUk2hoUy7GTI0dN9Z2sE/AvwJKYIAw/BVhe8vSip3Wokwij2d5I1ytGs
H0WSNgYgvhocR/Y3RWdewMdG2SXwsJzOyDzQ3sGPba7JRV6oXHNipj179wMsum0y
PwvgoBnYWmmV1T4IJlLgXG9QMNGSBQeqVKFotYlvwT+V18PdfKf9Sg==
=NGK0
-----END PGP SIGNATURE-----
VAR-201004-0487 | CVE-2010-1465 |
Trellian FTP Client stack-based buffer overflow vulnerability
Related entries in the VARIoT exploits database: VAR-E-201006-0218, VAR-E-201004-0213 |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitrary code via a long PASV response. Trellian FTP is a popular FTP client. A stack overflow vulnerability exists in the Trellian FTP client when processing FTP responses.
An attacker may exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will likely cause denial-of-service conditions. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
Trellian FTP PASV Response Buffer Overflow Vulnerability
SECUNIA ADVISORY ID:
SA39370
VERIFY ADVISORY:
http://secunia.com/advisories/39370/
DESCRIPTION:
A vulnerability has been discovered in Trellian FTP, which can be
exploited by malicious people to compromise a user's system.
The vulnerability is confirmed in version 3.1.3.1789. Other versions
may also be affected.
SOLUTION:
Do not connect to untrusted FTP servers.
PROVIDED AND/OR DISCOVERED BY:
zombiefx
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201004-0208 | CVE-2010-0885 | Oracle Sun Product Suite of Sun Java System Communications Express Component vulnerabilities |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in the Sun Java System Communications Express component in Oracle Sun Product Suite 6 2005Q4 (6.2) and and 6.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Address Book. No detailed vulnerability details are currently available.
The vulnerability can be exploited over the 'HTTP' protocol.
This vulnerability affects the following supported versions:
6 2005Q4 (6.2), 6.3.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Technical Cyber Security Alert TA10-103B
Oracle Updates for Multiple Vulnerabilities
Original release date: April 13, 2010
Last revised: --
Source: US-CERT
Systems Affected
* Oracle Database 11g, versions 11.1.0.7 and 11.2.0.1
* Oracle Database 10g Release 2, versions 10.2.0.3 and 10.2.0.4
* Oracle Database 10g, version 10.1.0.5
* Oracle Database 9i Release 2, versions 9.2.0.8 and 9.2.0.8DV
* Oracle Application Server 10gR2, version 10.1.2.3.0
* Oracle Identity Management 10g, version 10.1.4.0.1 and 10.1.4.3
* Oracle Collaboration Suite 10g, version 10.1.2.4
* Oracle E-Business Suite Release 12, versions 12.0.4, 12.0.5, 12.0.6, 12.1.1 and 12.1.2
* Oracle E-Business Suite Release 11i, versions 11.5.10 and 11.5.10.2
* Oracle Transportation Manager, versions 5.5.05.07, 5.5.06.00, and 6.0.03
* Oracle Agile - Engineering Data Management, version 6.1.1.0
* PeopleSoft Enterprise PeopleTools, versions 8.49 and 8.50
* Oracle Communications Unified Inventory Management version 7.1
* Oracle Clinical Remote Data Capture Option versions 4.5.3 and 4.6
* Oracle Thesaurus Management System versions 4.5.2, 4.6 and 4.6.1
* Oracle Retail Markdown Optimization version 13.1
* Oracle Retail Place In-Season version 12.2
* Oracle Retail Plan In-Season version 12.2
* Oracle Sun Products Suite
Overview
The Oracle products and components listed above are affected by
multiple vulnerabilities. The impacts of these vulnerabilities
include remote execution of arbitrary code, information disclosure,
and denial of service.
I. Description
The Oracle Critical Patch Update Advisory - April 2010 addresses 47
vulnerabilities in various Oracle products and components,
including 16 vulnerabilities in Sun Solaris. The Advisory provides
information about affected components, access and authorization
required for successful exploitation, and the impact from the
vulnerabilities on data confidentiality, integrity, and
availability.
Oracle has associated CVE identifiers with the vulnerabilities
addressed in this Critical Patch Update.
II. Impact
The impact of these vulnerabilities varies depending on the
product, component, and configuration of the system. Potential
consequences include the execution of arbitrary code or commands,
information disclosure, and denial of service. Vulnerable
components may be available to unauthenticated, remote attackers.
An attacker who compromises an Oracle database may be able to
access sensitive information.
III. Solution
Apply the appropriate patches or upgrade as specified in the Oracle
Critical Patch Update Advisory - April 2010. Note that this
document only lists newly corrected issues. Updates to patches for
previously known issues are not listed.
IV. References
* Oracle Critical Patch Update Advisory - April 2010 -
<http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuapr2010.html>
* Sun Security Blog - <http://blogs.sun.com/security/>
* Sun Product Alerts related to April 2010 CPU -
<http://search.sun.com/main/index.jsp?nh=100&rf=1&dedupe=false&reslang=en&col=main-support-sunalerts&optstat=true&qt=This+publication+relates+to+the+CPU+for+April+2010>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA10-103B.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA10-103B Feedback VU#591801" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
April 13, 2010: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBS8TsTz6pPKYJORa3AQLfYgf/VmfoGA7YXur4adESvwQhh/sssh0SEt3S
OCs9vFecRb/SuBrYtlUVSuHQdkkeoNdJ62ByNi4NY1kRF0v/tFtr2la2cRcIpxJ/
XIMFpl5lx628iEtXwnemHpm+0BGc9j+rRwIQV/oDKP57629x7jZkiVwj53WIv8tR
M8ktq9kjzUk2hoUy7GTI0dN9Z2sE/AvwJKYIAw/BVhe8vSip3Wokwij2d5I1ytGs
H0WSNgYgvhocR/Y3RWdewMdG2SXwsJzOyDzQ3sGPba7JRV6oXHNipj179wMsum0y
PwvgoBnYWmmV1T4IJlLgXG9QMNGSBQeqVKFotYlvwT+V18PdfKf9Sg==
=NGK0
-----END PGP SIGNATURE-----
VAR-201004-0267 | CVE-2010-1138 | VMWare product vmware-vmx Virtual Network Stack Information Disclosure Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware Server 2.x, and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process. plural VMware Product virtual network stack host OS A vulnerability exists in which important information is obtained from the above memory.Hosted by a third party OS Important information may be obtained from the above memory. VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. VMWare products do not implement the virtual network stack correctly. Users on the guest operating system can obtain partial memory from the host's vmware-vmx process. Multiple VMware-hosted products are prone to an information-disclosure vulnerability. This can allow the attackers to harvest potentially sensitive information that can aid in further attacks.
The following applications are vulnerable:
Workstation
Player
ACE
Server
Fusion
NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities), but has been given its own record to better document it. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
VMware Server Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA39215
VERIFY ADVISORY:
http://secunia.com/advisories/39215/
DESCRIPTION:
Some vulnerabilities have been reported in VMware Server, which can
be exploited by malicious, local users to disclose sensitive
information or gain escalated privileges, and by malicious people to
disclose sensitive information, cause a DoS (Denial of Service), or
potentially compromise a user's system.
For more information see vulnerabilities #3 through #7 in:
SA39206
SOLUTION:
Restrict local access to trusted users only. Do not open untrusted
images or video files.
ORIGINAL ADVISORY:
VMSA-2010-0007:
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
OTHER REFERENCES:
SA39206:
http://secunia.com/advisories/39206/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2010-0007
Synopsis: VMware hosted products, vCenter Server and ESX
patches resolve multiple security issues
Issue date: 2010-04-09
Updated on: 2010-04-09 (initial release of advisory)
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042
CVE-2009-1564 CVE-2009-1565 CVE-2009-3732
CVE-2009-3707 CVE-2010-1138 CVE-2010-1139
CVE-2010-1141
- -------------------------------------------------------------------------
1. Summary
VMware hosted products, vCenter Server and ESX patches resolve
multiple security issues.
2.
Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan
to upgrade to at least ESX 3.0.3 and preferably to the newest
release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.
End of General Support for VMware Workstation 6.x is 2011-04-27,
users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users
should plan to upgrade to the newest release of either ESXi or
VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users
should plan to upgrade to the newest release of vCenter Server.
3. Problem Description
a. Windows-based VMware Tools Unsafe Library Loading vulnerability
A vulnerability in the way VMware libraries are referenced allows
for arbitrary code execution in the context of the logged on user. This file could be in any file format. The attacker will
need to have the ability to host their malicious files on a
network share.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
Steps needed to remediate this vulnerability:
Guest systems on VMware Workstation, Player, ACE, Server, Fusion
- Install the remediated version of Workstation, Player, ACE,
Server and Fusion.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details. Windows-based VMware Tools Arbitrary Code Execution vulnerability
A vulnerability in the way VMware executables are loaded allows for
arbitrary code execution in the context of the logged on user.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the Virtual Machine of the user. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c. Windows-based VMware Workstation and Player host privilege
escalation
A vulnerability in the USB service allows for a privilege
escalation. A local attacker on the host of a Windows-based
Operating System where VMware Workstation or VMware Player
is installed could plant a malicious executable on the host and
elevate their privileges.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. VMware VMnc Codec heap overflow vulnerabilities
The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.
Vulnerabilities in the decoder allow for execution of arbitrary
code with the privileges of the user running an application
utilizing the vulnerable codec.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below. VMware Remote Console format string vulnerability
VMware Remote Console (VMrc) contains a format string vulnerability.
Exploitation of this issue may lead to arbitrary code execution on
the system where VMrc is installed.
For an attack to be successful, an attacker would need to trick the
VMrc user into opening a malicious Web page or following a malicious
URL. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Linux-based vmrun format string vulnerability
A format string vulnerability in vmrun could allow arbitrary code
execution.
If a vmrun command is issued and processes are listed, code could
be executed in the context of the user listing the processes.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
VIX API any Windows not affected
VIX API 1.6.x Linux upgrade to VIX API 1.7 or later
VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows not affected
Workstation 6.5.x Linux 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x Windows not affected
Player 2.5.x Linux 2.5.4 build 246459 or later
Ace any Windows not affected
Server 2.x Windows not affected
Server 2.x Linux not being fixed at this time
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
4. Solution
Please review the patch/release notes for your product and version
and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
--------------------------------------------------
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe
md5sum: ea2ac5907ae4c5c323147fe155443ab8
sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools
md5sum: a896f7aaedde8799f21b52b89f5fc9ef
sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools
md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874
sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools
md5sum: 808682eaa6b202fa29172821f7378768
sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools
md5sum: 5116e27e7b13a76693402577bd9fda58
sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit
Linux 32-bit .rpm
md5sum: 9efb43a604d50e541eb3be7081b8b198
sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit
Linux 32-bit .bundle
md5sum: 38760682ad3b2f6bfb4e40f424c95c2a
sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit
Linux 64-bit .rpm
md5sum: 24311492bc515e9bc98eff9b2e7d33a2
sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit
Linux 64-bit .bundle
md5sum: ed24296705ad48442549d9cb2b3c0d8d
sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
-------------------
http://downloads.vmware.com/tryvmware/?p=player&lp=default
Release notes:
http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit
md5sum: 78c92c0242c9540f68a629d4ac49c516
sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle)
md5sum: e7cd19d39c7bbd1aee582743d76a7863
sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle)
md5sum: 88b08537c6eea705883dc1755b97738c
sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit
md5sum: 2c46fc7e2516f331eb4dd23154d00a54
sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux
md5sum: 8b0994a26363246b5e954f97bd5a088d
sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux
md5sum: ef7b9890c52b1e333f2357760a7fff85
sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
-------------------
http://downloads.vmware.com/download/player/player_reg.html
Release notes:
http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe)
md5sum: 531140a1eeed7d8b71f726b3d32a9174
sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm)
md5sum: 1905f61af490f9760bef54450747e708
sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle)
md5sum: 74f539005687a4efce7971f7ef019af5
sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm)
md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39
sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle)
md5sum: 175ce2f9656ff10a1327c0d48f80c65f
sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN
Release notes:
http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance
md5sum: e26d258c511572064e99774fbac9184c
sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows
md5sum: e970828f2a5a62ac108879033a70f4b6
sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9
md5sum: 59b3ad5964daef2844e72fd1765590fc
sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4
md5sum: 6623f6a8a645402a1c8c351ec99a1889
sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN
Release notes:
http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance
AMS Virtual Appliance .zip
md5sum: 3935f23d4a074e7a3429a1c80cfd2155
sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows
Windows .exe
md5sum: 1173bd7da6ed330a262ed4e2eff6562c
sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9
SLES 9 .rpm
md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208
sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4
RHEL 4 .rpm
md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5
sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2
Version 2.0.2 | 203138 - 10/26/09
507 MB EXE image VMware Server 2 for Windows Operating Systems. A
master installer file containing all Windows components of VMware
Server.
md5sum: a6430bcc16ff7b3a29bb8da1704fc38a
sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b
VIX API 1.6 for Windows
Version 2.0.2 | 203138 - 10/26/09
37 MB image
md5sum: 827e65e70803ec65ade62dd27a74407a
sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22
For Linux
VMware Server 2 for Linux Operating Systems.
Version 2.0.2 | 203138 - 10/26/09
37 MB TAR image
md5sum: 95ddea5a0579a35887bd15b083ffea20
sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
452 MB RPM image
md5sum: 35c8b176601133749e4055e0034f8be6
sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
451 MB TAR image
md5sum: cc7aef813008eeb7150c21547d431b39
sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474
VMware Fusion 3.0.2
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302
Release notes:
http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html
VMware Fusion 3.0.2 (for Intel-based Macs)
md5sum: aa17278a4a668eeb9f9467e4e3111ccc
sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3
VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs)
md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896
sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01
VMware Fusion 2.0.7
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207
Release notes:
http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html
VMware Fusion 2.0.7 (for Intel-based Macs)
md5sum: a293f5ce6ccc227760640753386e9da6
sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370
VMware Fusion 2.0.7 Light (for Intel-based Macs)
md5sum: d4772d118fb90323f598849e70c21189
sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77
VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713
----------------------------------------------
VIX API for Window 32-bit and 64-bit
Main installation file for Windows 32-bit and 64-bit host
md5sum:b494fc3092f07d0f29cc06a19fe61306
sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9
VIX API for Linux 32-bit
md5sum:6b0ed8872d8b714363cddc68b6a77008
sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1
VIX API for Linux 64-bit
md5sum:d57aa9f98058d5a386c18e14cc05bf4d
sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b
VIX API Version: 1.8.1 | 2009-10-11 | 207905
---------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:4f21e4cb518767bc08045f5a39f5d41f
sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12
VIX API for Linux 32-bit
md5sum:f347e94d907c26754540d59956ee5d53
sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907
VIX API for Linux 64-bit
md5sum:b8a3982072d0d42c0c37dd7eb49d686c
sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8
VIX API Version: 1.10 Beta | 01/28/10 | 222403
----------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:ac5b6e9197cb68c302bfac9ed683e3af
sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73
VIX API for Linux 32-bit
md5sum:07d1989d042e317eb9d2b3daf269dda7
sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c
VIX API for Linux 64-bit
md5sum:9b345008e0adec3c044988307294944b
sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b
ESXi
----
ESXi 4.0 bulletin ESXi400-201002402-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip
md5sum: e5aa2968d389594abdc59cbac7b0183d
sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2
http://kb.vmware.com/kb/1018404
ESXi 3.5
--------
ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in
ESXe350-200912401-O-BG from December 2009.
The same patch, ESXe350-200912402-T-BG, is also contained in
ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also
included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update)
http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the
VI Client "C" are contained in a single offline "O" download file.
ESX
---
ESX 4.0 bulletin ESX400-201002401-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip
md5sum: de62cbccaffa4b2b6831617f18c1ccb4
sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab
http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix,
ESX400-201002401-BG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip
md5sum: 99c1fcafbf0ca105ce73840d686e9914
sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb
http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix,
ESX400-200911223-UG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG
http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip
md5sum: f1d3589745b4ae933554785aef22bacc
sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47
http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG
http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip
md5sum: 49ee56b687707cbe6999836c315f081a
http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15
http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz
md5sum: c346fe510b6e51145570e03083f77357
sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4
http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
5. References
http://www.acrossecurity.com/advisories.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
6. Change log
2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion
2.0.7 on 2010-04-08.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT
d58bjKG6Ic7m/TsoJP4M2tw=
=Q1zv
-----END PGP SIGNATURE-----
VAR-201004-0525 | No CVE | Fujitsu Accela BizSearch Unspecified Search Result Information Disclosure Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Fujitsu Accela BizSearch is prone to an unspecified information-disclosure vulnerability.
Attackers can exploit this issue to gain access to sensitive information that may lead to further attacks.
The following products are affected:
eAccela BizSearch 1.0
eAccela BizSearch 2.0
eAccela BizSearch 2.1
Accela BizSearch 3.0
Accela BizSearch 3,1
IntelligentSearch for WindowsNT 2.0L10
IntelligentSearch for WindowsNT 2.0L20
VAR-201004-0521 | No CVE | Accela BizSearch Access Control Bypass Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: Medium |
The local file seraching function in IntelligentSearch and Accela BizSearch is prone to an access control bypass vulnerability.Users without permission can access restricted files on the local Windows machine via the BizSearch search results. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
Fujitsu IntelligentSearch Information Disclosure Vulnerability
SECUNIA ADVISORY ID:
SA39366
VERIFY ADVISORY:
http://secunia.com/advisories/39366/
DESCRIPTION:
A vulnerability has been reported in Fujitsu IntelligentSearch, which
can be exploited by malicious people to disclose sensitive
information.
The vulnerability is caused due to an unspecified error, which can be
exploited to disclose files via the search results.
This is related to:
SA39283
SOLUTION:
Contact the vendor for patches.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://software.fujitsu.com/jp/security/products-fujitsu/solution/bizsearch201001.html
OTHER REFERENCES:
SA39283:
http://secunia.com/advisories/39283/
JVNDB-2010-001204:
http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-001204.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201004-0995 | CVE-2010-1140 | VMWare product USB Service Local Privilege Escalation Vulnerability |
CVSS V2: 6.9 CVSS V3: - Severity: MEDIUM |
The USB service in VMware Workstation 7.0 before 7.0.1 build 227600 and VMware Player 3.0 before 3.0.1 build 227600 on Windows might allow host OS users to gain privileges by placing a Trojan horse program at an unspecified location on the host OS disk. VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. On recent versions of Windows, only users with administrative privileges can successfully perform an attack. Multiple VMware products are prone to a local privilege-escalation vulnerability.
Local attackers can exploit this issue to execute arbitrary code with elevated privileges; this may aid in other attacks. This issue only affects Windows host operating systems.
NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities), but has been given its own record to better document it. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2010-0007
Synopsis: VMware hosted products, vCenter Server and ESX
patches resolve multiple security issues
Issue date: 2010-04-09
Updated on: 2010-04-09 (initial release of advisory)
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042
CVE-2009-1564 CVE-2009-1565 CVE-2009-3732
CVE-2009-3707 CVE-2010-1138 CVE-2010-1139
CVE-2010-1141
- -------------------------------------------------------------------------
1.
2. Relevant releases
VMware Workstation 7.0,
VMware Workstation 6.5.3 and earlier,
VMware Player 3.0,
VMware Player 2.5.3 and earlier,
VMware ACE 2.6,
VMware ACE 2.5.3 and earlier,
VMware Server 2.0.2 and earlier,
VMware Fusion 3.0,
VMware Fusion 2.0.6 and earlier,
VMware VIX API for Windows 1.6.x,
VMware ESXi 4.0 before patch ESXi400-201002402-BG
VMware ESXi 3.5 before patch ESXe350-200912401-T-BG
VMware ESX 4.0 without patches ESX400-201002401-BG,
ESX400-200911223-UG
VMware ESX 3.5 without patch ESX350-200912401-BG
VMware ESX 3.0.3 without patch ESX303-201002203-UG
VMware ESX 2.5.5 without Upgrade Patch 15.
Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan
to upgrade to at least ESX 3.0.3 and preferably to the newest
release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.
End of General Support for VMware Workstation 6.x is 2011-04-27,
users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users
should plan to upgrade to the newest release of either ESXi or
VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users
should plan to upgrade to the newest release of vCenter Server.
3. Problem Description
a. Windows-based VMware Tools Unsafe Library Loading vulnerability
A vulnerability in the way VMware libraries are referenced allows
for arbitrary code execution in the context of the logged on user.
In order for an attacker to exploit the vulnerability, the attacker
would need to lure the user that is logged on a Windows Guest
Operating System to click on the attacker's file on a network
share. This file could be in any file format. The attacker will
need to have the ability to host their malicious files on a
network share.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
Steps needed to remediate this vulnerability:
Guest systems on VMware Workstation, Player, ACE, Server, Fusion
- Install the remediated version of Workstation, Player, ACE,
Server and Fusion.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.x any not affected
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x any 2.5.4 build 246459 or later
ACE 2.6.x Windows not affected
ACE 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any 2.0.2 build 203138 or later
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.6 build 246742 or later
ESXi 4.0 ESXi ESXi400-201002402-BG
ESXi 3.5 ESXi ESXe350-200912401-T-BG or later
ESX 4.0 ESX ESX400-201002401-BG
ESX 3.5 ESX ESX350-200912401-BG
ESX 3.0.3 ESX ESX303-201002203-UG
ESX 2.5.5 ESX Upgrade Patch 15
b. Windows-based VMware Tools Arbitrary Code Execution vulnerability
A vulnerability in the way VMware executables are loaded allows for
arbitrary code execution in the context of the logged on user.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the Virtual Machine of the user. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x any not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.0 Linux not affected
Player 2.5.x any not affected
Ace any any not affected
Server 2.x any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
d. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not applicable
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x any 2.5.4 build 246459 or later
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion any any Mac OS/X not affected
ESXi any ESXi not applicable
ESX any ESX not applicable
e. VMware VMnc Codec heap overflow vulnerabilities
The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.
Vulnerabilities in the decoder allow for execution of arbitrary
code with the privileges of the user running an application
utilizing the vulnerable codec.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Movie Decoder any Windows 6.5.4 Build 246459 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.x any not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
ACE any any not affected
Server 2.x Window not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
f.
For an attack to be successful, an attacker would need to trick the
VMrc user into opening a malicious Web page or following a malicious
URL. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.x Linux not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x Windows not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any any not affected
ESX any any not affected
h. Potential information leak via hosted networking stack
A vulnerability in the virtual networking stack of VMware hosted
products could allow host information disclosure.
A guest operating system could send memory from the host vmware-vmx
process to the virtual network adapter and potentially to the
host's physical Ethernet wire.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion 3.0 Mac OS/X 3.0.1 build 232708 or later
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
i. Linux-based vmrun format string vulnerability
A format string vulnerability in vmrun could allow arbitrary code
execution.
If a vmrun command is issued and processes are listed, code could
be executed in the context of the user listing the processes.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
VIX API any Windows not affected
VIX API 1.6.x Linux upgrade to VIX API 1.7 or later
VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows not affected
Workstation 6.5.x Linux 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x Windows not affected
Player 2.5.x Linux 2.5.4 build 246459 or later
Ace any Windows not affected
Server 2.x Windows not affected
Server 2.x Linux not being fixed at this time
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
4. Solution
Please review the patch/release notes for your product and version
and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
--------------------------------------------------
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe
md5sum: ea2ac5907ae4c5c323147fe155443ab8
sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools
md5sum: a896f7aaedde8799f21b52b89f5fc9ef
sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools
md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874
sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools
md5sum: 808682eaa6b202fa29172821f7378768
sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools
md5sum: 5116e27e7b13a76693402577bd9fda58
sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit
Linux 32-bit .rpm
md5sum: 9efb43a604d50e541eb3be7081b8b198
sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit
Linux 32-bit .bundle
md5sum: 38760682ad3b2f6bfb4e40f424c95c2a
sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit
Linux 64-bit .rpm
md5sum: 24311492bc515e9bc98eff9b2e7d33a2
sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit
Linux 64-bit .bundle
md5sum: ed24296705ad48442549d9cb2b3c0d8d
sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
-------------------
http://downloads.vmware.com/tryvmware/?p=player&lp=default
Release notes:
http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit
md5sum: 78c92c0242c9540f68a629d4ac49c516
sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle)
md5sum: e7cd19d39c7bbd1aee582743d76a7863
sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle)
md5sum: 88b08537c6eea705883dc1755b97738c
sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit
md5sum: 2c46fc7e2516f331eb4dd23154d00a54
sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux
md5sum: 8b0994a26363246b5e954f97bd5a088d
sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux
md5sum: ef7b9890c52b1e333f2357760a7fff85
sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
-------------------
http://downloads.vmware.com/download/player/player_reg.html
Release notes:
http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe)
md5sum: 531140a1eeed7d8b71f726b3d32a9174
sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm)
md5sum: 1905f61af490f9760bef54450747e708
sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle)
md5sum: 74f539005687a4efce7971f7ef019af5
sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm)
md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39
sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle)
md5sum: 175ce2f9656ff10a1327c0d48f80c65f
sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN
Release notes:
http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance
md5sum: e26d258c511572064e99774fbac9184c
sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows
md5sum: e970828f2a5a62ac108879033a70f4b6
sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9
md5sum: 59b3ad5964daef2844e72fd1765590fc
sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4
md5sum: 6623f6a8a645402a1c8c351ec99a1889
sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN
Release notes:
http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance
AMS Virtual Appliance .zip
md5sum: 3935f23d4a074e7a3429a1c80cfd2155
sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows
Windows .exe
md5sum: 1173bd7da6ed330a262ed4e2eff6562c
sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9
SLES 9 .rpm
md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208
sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4
RHEL 4 .rpm
md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5
sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2
Version 2.0.2 | 203138 - 10/26/09
507 MB EXE image VMware Server 2 for Windows Operating Systems. A
master installer file containing all Windows components of VMware
Server.
md5sum: a6430bcc16ff7b3a29bb8da1704fc38a
sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b
VIX API 1.6 for Windows
Version 2.0.2 | 203138 - 10/26/09
37 MB image
md5sum: 827e65e70803ec65ade62dd27a74407a
sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22
For Linux
VMware Server 2 for Linux Operating Systems.
Version 2.0.2 | 203138 - 10/26/09
37 MB TAR image
md5sum: 95ddea5a0579a35887bd15b083ffea20
sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
452 MB RPM image
md5sum: 35c8b176601133749e4055e0034f8be6
sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
451 MB TAR image
md5sum: cc7aef813008eeb7150c21547d431b39
sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474
VMware Fusion 3.0.2
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302
Release notes:
http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html
VMware Fusion 3.0.2 (for Intel-based Macs)
md5sum: aa17278a4a668eeb9f9467e4e3111ccc
sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3
VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs)
md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896
sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01
VMware Fusion 2.0.7
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207
Release notes:
http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html
VMware Fusion 2.0.7 (for Intel-based Macs)
md5sum: a293f5ce6ccc227760640753386e9da6
sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370
VMware Fusion 2.0.7 Light (for Intel-based Macs)
md5sum: d4772d118fb90323f598849e70c21189
sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77
VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713
----------------------------------------------
VIX API for Window 32-bit and 64-bit
Main installation file for Windows 32-bit and 64-bit host
md5sum:b494fc3092f07d0f29cc06a19fe61306
sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9
VIX API for Linux 32-bit
md5sum:6b0ed8872d8b714363cddc68b6a77008
sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1
VIX API for Linux 64-bit
md5sum:d57aa9f98058d5a386c18e14cc05bf4d
sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b
VIX API Version: 1.8.1 | 2009-10-11 | 207905
---------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:4f21e4cb518767bc08045f5a39f5d41f
sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12
VIX API for Linux 32-bit
md5sum:f347e94d907c26754540d59956ee5d53
sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907
VIX API for Linux 64-bit
md5sum:b8a3982072d0d42c0c37dd7eb49d686c
sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8
VIX API Version: 1.10 Beta | 01/28/10 | 222403
----------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:ac5b6e9197cb68c302bfac9ed683e3af
sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73
VIX API for Linux 32-bit
md5sum:07d1989d042e317eb9d2b3daf269dda7
sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c
VIX API for Linux 64-bit
md5sum:9b345008e0adec3c044988307294944b
sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b
ESXi
----
ESXi 4.0 bulletin ESXi400-201002402-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip
md5sum: e5aa2968d389594abdc59cbac7b0183d
sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2
http://kb.vmware.com/kb/1018404
ESXi 3.5
--------
ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in
ESXe350-200912401-O-BG from December 2009.
The same patch, ESXe350-200912402-T-BG, is also contained in
ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also
included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update)
http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the
VI Client "C" are contained in a single offline "O" download file.
ESX
---
ESX 4.0 bulletin ESX400-201002401-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip
md5sum: de62cbccaffa4b2b6831617f18c1ccb4
sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab
http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix,
ESX400-201002401-BG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip
md5sum: 99c1fcafbf0ca105ce73840d686e9914
sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb
http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix,
ESX400-200911223-UG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG
http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip
md5sum: f1d3589745b4ae933554785aef22bacc
sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47
http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG
http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip
md5sum: 49ee56b687707cbe6999836c315f081a
http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15
http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz
md5sum: c346fe510b6e51145570e03083f77357
sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4
http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
5. References
http://www.acrossecurity.com/advisories.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
6. Change log
2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion
2.0.7 on 2010-04-08.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT
d58bjKG6Ic7m/TsoJP4M2tw=
=Q1zv
-----END PGP SIGNATURE-----
.
Background
==========
VMware Player, Server, and Workstation allow emulation of a complete PC
on a PC without the usual performance overhead of most emulators.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-emulation/vmware-player
<= 2.5.5.328052 Vulnerable!
2 app-emulation/vmware-workstation
<= 6.5.5.328052 Vulnerable!
3 app-emulation/vmware-server
<= 1.0.9.156507 Vulnerable!
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers. Please review the CVE identifiers referenced below for
details.
A remote attacker could entice a user to open a specially crafted file,
possibly resulting in the remote execution of arbitrary code, or a
Denial of Service. Remote attackers also may be able to spoof DNS
traffic, read arbitrary files, or inject arbitrary web script to the
VMware Server Console.
Workaround
==========
There is no known workaround at this time. We recommend that users
unmerge VMware Server:
# emerge --unmerge "app-emulation/vmware-server"
References
==========
[ 1 ] CVE-2007-5269
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269
[ 2 ] CVE-2007-5503
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5503
[ 3 ] CVE-2007-5671
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5671
[ 4 ] CVE-2008-0967
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0967
[ 5 ] CVE-2008-1340
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1340
[ 6 ] CVE-2008-1361
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1361
[ 7 ] CVE-2008-1362
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1362
[ 8 ] CVE-2008-1363
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1363
[ 9 ] CVE-2008-1364
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1364
[ 10 ] CVE-2008-1392
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1392
[ 11 ] CVE-2008-1447
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1447
[ 12 ] CVE-2008-1806
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1806
[ 13 ] CVE-2008-1807
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1807
[ 14 ] CVE-2008-1808
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1808
[ 15 ] CVE-2008-2098
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2098
[ 16 ] CVE-2008-2100
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2100
[ 17 ] CVE-2008-2101
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2101
[ 18 ] CVE-2008-4915
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4915
[ 19 ] CVE-2008-4916
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4916
[ 20 ] CVE-2008-4917
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4917
[ 21 ] CVE-2009-0040
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0040
[ 22 ] CVE-2009-0909
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0909
[ 23 ] CVE-2009-0910
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0910
[ 24 ] CVE-2009-1244
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1244
[ 25 ] CVE-2009-2267
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2267
[ 26 ] CVE-2009-3707
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3707
[ 27 ] CVE-2009-3732
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3732
[ 28 ] CVE-2009-3733
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3733
[ 29 ] CVE-2009-4811
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4811
[ 30 ] CVE-2010-1137
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1137
[ 31 ] CVE-2010-1138
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1138
[ 32 ] CVE-2010-1139
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1139
[ 33 ] CVE-2010-1140
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1140
[ 34 ] CVE-2010-1141
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1141
[ 35 ] CVE-2010-1142
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1142
[ 36 ] CVE-2010-1143
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1143
[ 37 ] CVE-2011-3868
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3868
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-25.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
VMware Products Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA39206
VERIFY ADVISORY:
http://secunia.com/advisories/39206/
DESCRIPTION:
Some vulnerabilities have been reported in multiple VMware products,
which can be exploited by malicious, local users to disclose
sensitive information or gain escalated privileges, and by malicious
people to disclose sensitive information, cause a DoS (Denial of
Service), or potentially compromise a user's system. Windows XP and Windows
Vista).
3) An error in libpng can be exploited to disclose uninitialised
memory via a specially crafted image.
For more information:
SA35346
4) A boundary error and two integer truncation errors in the VMnc
codec can be exploited to potentially execute arbitrary code.
For more information:
SA36712
5) An error in the VMware Authorization Service ("vmware-authd") can
be exploited to cause a crash.
For more information:
SA39203
7) A format string error in "vmrun" can be exploited to potentially
gain escalated privileges.
For more information:
SA39201
SOLUTION:
Update to a fixed version.
PROVIDED AND/OR DISCOVERED BY:
4) Alin Rad Pop, Secunia Research
The vendor also credits:
1) Jure Skofic and Mitja Kolsek of ACROS Security
2) Thierry Zoller
4) iDefense and Sebastien Renaud of Vupen
6) Johann MacDonagh
7) Thomas Toth-Steiner
ORIGINAL ADVISORY:
VMware (VMSA-2010-0007):
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
Secunia Research:
http://secunia.com/secunia_research/2009-36/
http://secunia.com/secunia_research/2009-37/
OTHER REFERENCES:
SA35346:
http://secunia.com/advisories/35346/
SA36712:
http://secunia.com/advisories/36712/
SA36988:
http://secunia.com/advisories/36988/
SA39198:
http://secunia.com/advisories/39198/
SA39201:
http://secunia.com/advisories/39201/
SA39203:
http://secunia.com/advisories/39203/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201004-0997 | CVE-2009-1565 | VMnc Vulnerability to execute arbitrary code in media codec and movie decoder |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted HexTile-encoded video chunks that trigger heap-based buffer overflows, related to "integer truncation errors.". VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. The VMWare Media Decoder contains a VMnc media codec for playing movies recorded by VMware Workstation, VMware Player, and VMware ACE. The vmnc.dll library has two integer truncation errors when processing HexTile encoded video blocks. Multiple VMware products are prone to multiple heap-based buffer-overflow vulnerabilities.
An attacker can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote Vulnerabilities) but has been assigned its own record to better document it. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2010-0007
Synopsis: VMware hosted products, vCenter Server and ESX
patches resolve multiple security issues
Issue date: 2010-04-09
Updated on: 2010-04-09 (initial release of advisory)
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042
CVE-2009-1564 CVE-2009-1565 CVE-2009-3732
CVE-2009-3707 CVE-2010-1138 CVE-2010-1139
CVE-2010-1141
- -------------------------------------------------------------------------
1.
2.
Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan
to upgrade to at least ESX 3.0.3 and preferably to the newest
release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.
End of General Support for VMware Workstation 6.x is 2011-04-27,
users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users
should plan to upgrade to the newest release of either ESXi or
VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users
should plan to upgrade to the newest release of vCenter Server.
3. Problem Description
a. Windows-based VMware Tools Unsafe Library Loading vulnerability
A vulnerability in the way VMware libraries are referenced allows
for arbitrary code execution in the context of the logged on user.
This vulnerability is present only on Windows Guest Operating
Systems.
In order for an attacker to exploit the vulnerability, the attacker
would need to lure the user that is logged on a Windows Guest
Operating System to click on the attacker's file on a network
share. This file could be in any file format. The attacker will
need to have the ability to host their malicious files on a
network share.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
Steps needed to remediate this vulnerability:
Guest systems on VMware Workstation, Player, ACE, Server, Fusion
- Install the remediated version of Workstation, Player, ACE,
Server and Fusion.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.x any not affected
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x any 2.5.4 build 246459 or later
ACE 2.6.x Windows not affected
ACE 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any 2.0.2 build 203138 or later
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.6 build 246742 or later
ESXi 4.0 ESXi ESXi400-201002402-BG
ESXi 3.5 ESXi ESXe350-200912401-T-BG or later
ESX 4.0 ESX ESX400-201002401-BG
ESX 3.5 ESX ESX350-200912401-BG
ESX 3.0.3 ESX ESX303-201002203-UG
ESX 2.5.5 ESX Upgrade Patch 15
b. This
vulnerability is present only on Windows Guest Operating Systems.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the Virtual Machine of the user. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c. Windows-based VMware Workstation and Player host privilege
escalation
A vulnerability in the USB service allows for a privilege
escalation. A local attacker on the host of a Windows-based
Operating System where VMware Workstation or VMware Player
is installed could plant a malicious executable on the host and
elevate their privileges.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x any not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.0 Linux not affected
Player 2.5.x any not affected
Ace any any not affected
Server 2.x any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
d. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not applicable
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x any 2.5.4 build 246459 or later
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion any any Mac OS/X not affected
ESXi any ESXi not applicable
ESX any ESX not applicable
e.
Vulnerabilities in the decoder allow for execution of arbitrary
code with the privileges of the user running an application
utilizing the vulnerable codec.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Movie Decoder any Windows 6.5.4 Build 246459 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.x any not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
ACE any any not affected
Server 2.x Window not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
f. VMware Remote Console format string vulnerability
VMware Remote Console (VMrc) contains a format string vulnerability.
For an attack to be successful, an attacker would need to trick the
VMrc user into opening a malicious Web page or following a malicious
URL. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.x Linux not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x Windows not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any any not affected
ESX any any not affected
h. Potential information leak via hosted networking stack
A vulnerability in the virtual networking stack of VMware hosted
products could allow host information disclosure.
A guest operating system could send memory from the host vmware-vmx
process to the virtual network adapter and potentially to the
host's physical Ethernet wire.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion 3.0 Mac OS/X 3.0.1 build 232708 or later
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
i. Linux-based vmrun format string vulnerability
A format string vulnerability in vmrun could allow arbitrary code
execution.
If a vmrun command is issued and processes are listed, code could
be executed in the context of the user listing the processes.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
VIX API any Windows not affected
VIX API 1.6.x Linux upgrade to VIX API 1.7 or later
VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows not affected
Workstation 6.5.x Linux 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x Windows not affected
Player 2.5.x Linux 2.5.4 build 246459 or later
Ace any Windows not affected
Server 2.x Windows not affected
Server 2.x Linux not being fixed at this time
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
4. Solution
Please review the patch/release notes for your product and version
and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
--------------------------------------------------
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe
md5sum: ea2ac5907ae4c5c323147fe155443ab8
sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools
md5sum: a896f7aaedde8799f21b52b89f5fc9ef
sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools
md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874
sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools
md5sum: 808682eaa6b202fa29172821f7378768
sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools
md5sum: 5116e27e7b13a76693402577bd9fda58
sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit
Linux 32-bit .rpm
md5sum: 9efb43a604d50e541eb3be7081b8b198
sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit
Linux 32-bit .bundle
md5sum: 38760682ad3b2f6bfb4e40f424c95c2a
sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit
Linux 64-bit .rpm
md5sum: 24311492bc515e9bc98eff9b2e7d33a2
sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit
Linux 64-bit .bundle
md5sum: ed24296705ad48442549d9cb2b3c0d8d
sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
-------------------
http://downloads.vmware.com/tryvmware/?p=player&lp=default
Release notes:
http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit
md5sum: 78c92c0242c9540f68a629d4ac49c516
sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle)
md5sum: e7cd19d39c7bbd1aee582743d76a7863
sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle)
md5sum: 88b08537c6eea705883dc1755b97738c
sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit
md5sum: 2c46fc7e2516f331eb4dd23154d00a54
sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux
md5sum: 8b0994a26363246b5e954f97bd5a088d
sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux
md5sum: ef7b9890c52b1e333f2357760a7fff85
sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
-------------------
http://downloads.vmware.com/download/player/player_reg.html
Release notes:
http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe)
md5sum: 531140a1eeed7d8b71f726b3d32a9174
sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm)
md5sum: 1905f61af490f9760bef54450747e708
sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle)
md5sum: 74f539005687a4efce7971f7ef019af5
sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm)
md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39
sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle)
md5sum: 175ce2f9656ff10a1327c0d48f80c65f
sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN
Release notes:
http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance
md5sum: e26d258c511572064e99774fbac9184c
sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows
md5sum: e970828f2a5a62ac108879033a70f4b6
sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9
md5sum: 59b3ad5964daef2844e72fd1765590fc
sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4
md5sum: 6623f6a8a645402a1c8c351ec99a1889
sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN
Release notes:
http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance
AMS Virtual Appliance .zip
md5sum: 3935f23d4a074e7a3429a1c80cfd2155
sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows
Windows .exe
md5sum: 1173bd7da6ed330a262ed4e2eff6562c
sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9
SLES 9 .rpm
md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208
sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4
RHEL 4 .rpm
md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5
sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2
Version 2.0.2 | 203138 - 10/26/09
507 MB EXE image VMware Server 2 for Windows Operating Systems. A
master installer file containing all Windows components of VMware
Server.
md5sum: a6430bcc16ff7b3a29bb8da1704fc38a
sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b
VIX API 1.6 for Windows
Version 2.0.2 | 203138 - 10/26/09
37 MB image
md5sum: 827e65e70803ec65ade62dd27a74407a
sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22
For Linux
VMware Server 2 for Linux Operating Systems.
Version 2.0.2 | 203138 - 10/26/09
37 MB TAR image
md5sum: 95ddea5a0579a35887bd15b083ffea20
sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
452 MB RPM image
md5sum: 35c8b176601133749e4055e0034f8be6
sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
451 MB TAR image
md5sum: cc7aef813008eeb7150c21547d431b39
sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474
VMware Fusion 3.0.2
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302
Release notes:
http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html
VMware Fusion 3.0.2 (for Intel-based Macs)
md5sum: aa17278a4a668eeb9f9467e4e3111ccc
sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3
VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs)
md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896
sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01
VMware Fusion 2.0.7
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207
Release notes:
http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html
VMware Fusion 2.0.7 (for Intel-based Macs)
md5sum: a293f5ce6ccc227760640753386e9da6
sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370
VMware Fusion 2.0.7 Light (for Intel-based Macs)
md5sum: d4772d118fb90323f598849e70c21189
sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77
VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713
----------------------------------------------
VIX API for Window 32-bit and 64-bit
Main installation file for Windows 32-bit and 64-bit host
md5sum:b494fc3092f07d0f29cc06a19fe61306
sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9
VIX API for Linux 32-bit
md5sum:6b0ed8872d8b714363cddc68b6a77008
sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1
VIX API for Linux 64-bit
md5sum:d57aa9f98058d5a386c18e14cc05bf4d
sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b
VIX API Version: 1.8.1 | 2009-10-11 | 207905
---------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:4f21e4cb518767bc08045f5a39f5d41f
sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12
VIX API for Linux 32-bit
md5sum:f347e94d907c26754540d59956ee5d53
sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907
VIX API for Linux 64-bit
md5sum:b8a3982072d0d42c0c37dd7eb49d686c
sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8
VIX API Version: 1.10 Beta | 01/28/10 | 222403
----------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:ac5b6e9197cb68c302bfac9ed683e3af
sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73
VIX API for Linux 32-bit
md5sum:07d1989d042e317eb9d2b3daf269dda7
sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c
VIX API for Linux 64-bit
md5sum:9b345008e0adec3c044988307294944b
sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b
ESXi
----
ESXi 4.0 bulletin ESXi400-201002402-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip
md5sum: e5aa2968d389594abdc59cbac7b0183d
sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2
http://kb.vmware.com/kb/1018404
ESXi 3.5
--------
ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in
ESXe350-200912401-O-BG from December 2009.
The same patch, ESXe350-200912402-T-BG, is also contained in
ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also
included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update)
http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the
VI Client "C" are contained in a single offline "O" download file.
ESX
---
ESX 4.0 bulletin ESX400-201002401-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip
md5sum: de62cbccaffa4b2b6831617f18c1ccb4
sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab
http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix,
ESX400-201002401-BG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip
md5sum: 99c1fcafbf0ca105ce73840d686e9914
sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb
http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix,
ESX400-200911223-UG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG
http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip
md5sum: f1d3589745b4ae933554785aef22bacc
sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47
http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG
http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip
md5sum: 49ee56b687707cbe6999836c315f081a
http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15
http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz
md5sum: c346fe510b6e51145570e03083f77357
sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4
http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
5. References
http://www.acrossecurity.com/advisories.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
6. Change log
2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion
2.0.7 on 2010-04-08.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT
d58bjKG6Ic7m/TsoJP4M2tw=
=Q1zv
-----END PGP SIGNATURE-----
.
For more information see vulnerabilities #3 through #7 in:
SA39206
SOLUTION:
Restrict local access to trusted users only. Do not open untrusted
images or video files. ======================================================================
Secunia Research 09/04/2010
- VMWare VMnc Codec HexTile Encoding -
- Two Integer Truncation Vulnerabilities -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
* VMWare Workstation version 6.5.3 build 185404.
NOTE: Other products and versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: Remote
======================================================================
3) Vendor's Description of Software
"VMware Workstation makes it simple to create and run multiple virtual
machines on your desktop or laptop computer.
======================================================================
6) Time Table
14/09/2009 - Vendor notified.
14/09/2009 - Vendor response.
09/04/2010 - Public disclosure.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2009-37/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
VMware Products Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA39206
VERIFY ADVISORY:
http://secunia.com/advisories/39206/
DESCRIPTION:
Some vulnerabilities have been reported in multiple VMware products,
which can be exploited by malicious, local users to disclose
sensitive information or gain escalated privileges, and by malicious
people to disclose sensitive information, cause a DoS (Denial of
Service), or potentially compromise a user's system.
NOTE: This vulnerability cannot be exploited without administrative
privileges on recent Windows versions (e.g. Windows XP and Windows
Vista).
3) An error in libpng can be exploited to disclose uninitialised
memory via a specially crafted image.
For more information:
SA35346
4) A boundary error and two integer truncation errors in the VMnc
codec can be exploited to potentially execute arbitrary code.
For more information:
SA36712
5) An error in the VMware Authorization Service ("vmware-authd") can
be exploited to cause a crash.
For more information:
SA39203
7) A format string error in "vmrun" can be exploited to potentially
gain escalated privileges.
For more information:
SA39201
SOLUTION:
Update to a fixed version.
PROVIDED AND/OR DISCOVERED BY:
4) Alin Rad Pop, Secunia Research
The vendor also credits:
1) Jure Skofic and Mitja Kolsek of ACROS Security
2) Thierry Zoller
4) iDefense and Sebastien Renaud of Vupen
6) Johann MacDonagh
7) Thomas Toth-Steiner
ORIGINAL ADVISORY:
VMware (VMSA-2010-0007):
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
Secunia Research:
http://secunia.com/secunia_research/2009-36/
http://secunia.com/secunia_research/2009-37/
OTHER REFERENCES:
SA35346:
http://secunia.com/advisories/35346/
SA36712:
http://secunia.com/advisories/36712/
SA36988:
http://secunia.com/advisories/36988/
SA39198:
http://secunia.com/advisories/39198/
SA39201:
http://secunia.com/advisories/39201/
SA39203:
http://secunia.com/advisories/39203/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201004-0994 | CVE-2010-1138 | VMWare product vmware-vmx Virtual Network Stack Information Disclosure Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware Server 2.x, and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process. plural VMware Product virtual network stack host OS A vulnerability exists in which important information is obtained from the above memory.Hosted by a third party OS Important information may be obtained from the above memory. VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. VMWare products do not implement the virtual network stack correctly. Users on the guest operating system can obtain partial memory from the host's vmware-vmx process. Multiple VMware-hosted products are prone to an information-disclosure vulnerability. This can allow the attackers to harvest potentially sensitive information that can aid in further attacks.
The following applications are vulnerable:
Workstation
Player
ACE
Server
Fusion
NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities), but has been given its own record to better document it. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2010-0007
Synopsis: VMware hosted products, vCenter Server and ESX
patches resolve multiple security issues
Issue date: 2010-04-09
Updated on: 2010-04-09 (initial release of advisory)
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042
CVE-2009-1564 CVE-2009-1565 CVE-2009-3732
CVE-2009-3707 CVE-2010-1138 CVE-2010-1139
CVE-2010-1141
- -------------------------------------------------------------------------
1. Summary
VMware hosted products, vCenter Server and ESX patches resolve
multiple security issues.
2.
Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan
to upgrade to at least ESX 3.0.3 and preferably to the newest
release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.
End of General Support for VMware Workstation 6.x is 2011-04-27,
users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users
should plan to upgrade to the newest release of either ESXi or
VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users
should plan to upgrade to the newest release of vCenter Server.
3. Problem Description
a. Windows-based VMware Tools Unsafe Library Loading vulnerability
A vulnerability in the way VMware libraries are referenced allows
for arbitrary code execution in the context of the logged on user. This file could be in any file format. The attacker will
need to have the ability to host their malicious files on a
network share.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
Steps needed to remediate this vulnerability:
Guest systems on VMware Workstation, Player, ACE, Server, Fusion
- Install the remediated version of Workstation, Player, ACE,
Server and Fusion.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details. Windows-based VMware Tools Arbitrary Code Execution vulnerability
A vulnerability in the way VMware executables are loaded allows for
arbitrary code execution in the context of the logged on user.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the Virtual Machine of the user. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c. Windows-based VMware Workstation and Player host privilege
escalation
A vulnerability in the USB service allows for a privilege
escalation. A local attacker on the host of a Windows-based
Operating System where VMware Workstation or VMware Player
is installed could plant a malicious executable on the host and
elevate their privileges.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. VMware VMnc Codec heap overflow vulnerabilities
The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.
Vulnerabilities in the decoder allow for execution of arbitrary
code with the privileges of the user running an application
utilizing the vulnerable codec.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below. VMware Remote Console format string vulnerability
VMware Remote Console (VMrc) contains a format string vulnerability.
Exploitation of this issue may lead to arbitrary code execution on
the system where VMrc is installed.
For an attack to be successful, an attacker would need to trick the
VMrc user into opening a malicious Web page or following a malicious
URL. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Linux-based vmrun format string vulnerability
A format string vulnerability in vmrun could allow arbitrary code
execution.
If a vmrun command is issued and processes are listed, code could
be executed in the context of the user listing the processes.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
VIX API any Windows not affected
VIX API 1.6.x Linux upgrade to VIX API 1.7 or later
VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows not affected
Workstation 6.5.x Linux 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x Windows not affected
Player 2.5.x Linux 2.5.4 build 246459 or later
Ace any Windows not affected
Server 2.x Windows not affected
Server 2.x Linux not being fixed at this time
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
4. Solution
Please review the patch/release notes for your product and version
and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
--------------------------------------------------
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe
md5sum: ea2ac5907ae4c5c323147fe155443ab8
sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools
md5sum: a896f7aaedde8799f21b52b89f5fc9ef
sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools
md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874
sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools
md5sum: 808682eaa6b202fa29172821f7378768
sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools
md5sum: 5116e27e7b13a76693402577bd9fda58
sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit
Linux 32-bit .rpm
md5sum: 9efb43a604d50e541eb3be7081b8b198
sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit
Linux 32-bit .bundle
md5sum: 38760682ad3b2f6bfb4e40f424c95c2a
sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit
Linux 64-bit .rpm
md5sum: 24311492bc515e9bc98eff9b2e7d33a2
sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit
Linux 64-bit .bundle
md5sum: ed24296705ad48442549d9cb2b3c0d8d
sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
-------------------
http://downloads.vmware.com/tryvmware/?p=player&lp=default
Release notes:
http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit
md5sum: 78c92c0242c9540f68a629d4ac49c516
sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle)
md5sum: e7cd19d39c7bbd1aee582743d76a7863
sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle)
md5sum: 88b08537c6eea705883dc1755b97738c
sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit
md5sum: 2c46fc7e2516f331eb4dd23154d00a54
sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux
md5sum: 8b0994a26363246b5e954f97bd5a088d
sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux
md5sum: ef7b9890c52b1e333f2357760a7fff85
sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
-------------------
http://downloads.vmware.com/download/player/player_reg.html
Release notes:
http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe)
md5sum: 531140a1eeed7d8b71f726b3d32a9174
sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm)
md5sum: 1905f61af490f9760bef54450747e708
sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle)
md5sum: 74f539005687a4efce7971f7ef019af5
sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm)
md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39
sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle)
md5sum: 175ce2f9656ff10a1327c0d48f80c65f
sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN
Release notes:
http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance
md5sum: e26d258c511572064e99774fbac9184c
sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows
md5sum: e970828f2a5a62ac108879033a70f4b6
sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9
md5sum: 59b3ad5964daef2844e72fd1765590fc
sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4
md5sum: 6623f6a8a645402a1c8c351ec99a1889
sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN
Release notes:
http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance
AMS Virtual Appliance .zip
md5sum: 3935f23d4a074e7a3429a1c80cfd2155
sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows
Windows .exe
md5sum: 1173bd7da6ed330a262ed4e2eff6562c
sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9
SLES 9 .rpm
md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208
sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4
RHEL 4 .rpm
md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5
sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2
Version 2.0.2 | 203138 - 10/26/09
507 MB EXE image VMware Server 2 for Windows Operating Systems. A
master installer file containing all Windows components of VMware
Server.
md5sum: a6430bcc16ff7b3a29bb8da1704fc38a
sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b
VIX API 1.6 for Windows
Version 2.0.2 | 203138 - 10/26/09
37 MB image
md5sum: 827e65e70803ec65ade62dd27a74407a
sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22
For Linux
VMware Server 2 for Linux Operating Systems.
Version 2.0.2 | 203138 - 10/26/09
37 MB TAR image
md5sum: 95ddea5a0579a35887bd15b083ffea20
sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
452 MB RPM image
md5sum: 35c8b176601133749e4055e0034f8be6
sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
451 MB TAR image
md5sum: cc7aef813008eeb7150c21547d431b39
sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474
VMware Fusion 3.0.2
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302
Release notes:
http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html
VMware Fusion 3.0.2 (for Intel-based Macs)
md5sum: aa17278a4a668eeb9f9467e4e3111ccc
sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3
VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs)
md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896
sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01
VMware Fusion 2.0.7
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207
Release notes:
http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html
VMware Fusion 2.0.7 (for Intel-based Macs)
md5sum: a293f5ce6ccc227760640753386e9da6
sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370
VMware Fusion 2.0.7 Light (for Intel-based Macs)
md5sum: d4772d118fb90323f598849e70c21189
sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77
VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713
----------------------------------------------
VIX API for Window 32-bit and 64-bit
Main installation file for Windows 32-bit and 64-bit host
md5sum:b494fc3092f07d0f29cc06a19fe61306
sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9
VIX API for Linux 32-bit
md5sum:6b0ed8872d8b714363cddc68b6a77008
sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1
VIX API for Linux 64-bit
md5sum:d57aa9f98058d5a386c18e14cc05bf4d
sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b
VIX API Version: 1.8.1 | 2009-10-11 | 207905
---------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:4f21e4cb518767bc08045f5a39f5d41f
sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12
VIX API for Linux 32-bit
md5sum:f347e94d907c26754540d59956ee5d53
sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907
VIX API for Linux 64-bit
md5sum:b8a3982072d0d42c0c37dd7eb49d686c
sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8
VIX API Version: 1.10 Beta | 01/28/10 | 222403
----------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:ac5b6e9197cb68c302bfac9ed683e3af
sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73
VIX API for Linux 32-bit
md5sum:07d1989d042e317eb9d2b3daf269dda7
sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c
VIX API for Linux 64-bit
md5sum:9b345008e0adec3c044988307294944b
sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b
ESXi
----
ESXi 4.0 bulletin ESXi400-201002402-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip
md5sum: e5aa2968d389594abdc59cbac7b0183d
sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2
http://kb.vmware.com/kb/1018404
ESXi 3.5
--------
ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in
ESXe350-200912401-O-BG from December 2009.
The same patch, ESXe350-200912402-T-BG, is also contained in
ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also
included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update)
http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the
VI Client "C" are contained in a single offline "O" download file.
ESX
---
ESX 4.0 bulletin ESX400-201002401-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip
md5sum: de62cbccaffa4b2b6831617f18c1ccb4
sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab
http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix,
ESX400-201002401-BG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip
md5sum: 99c1fcafbf0ca105ce73840d686e9914
sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb
http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix,
ESX400-200911223-UG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG
http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip
md5sum: f1d3589745b4ae933554785aef22bacc
sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47
http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG
http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip
md5sum: 49ee56b687707cbe6999836c315f081a
http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15
http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz
md5sum: c346fe510b6e51145570e03083f77357
sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4
http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
5. References
http://www.acrossecurity.com/advisories.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
6. Change log
2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion
2.0.7 on 2010-04-08.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT
d58bjKG6Ic7m/TsoJP4M2tw=
=Q1zv
-----END PGP SIGNATURE-----
.
For more information see vulnerabilities #3 through #7 in:
SA39206
SOLUTION:
Restrict local access to trusted users only. Do not open untrusted
images or video files.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Johann MacDonagh.
Background
==========
VMware Player, Server, and Workstation allow emulation of a complete PC
on a PC without the usual performance overhead of most emulators.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-emulation/vmware-player
<= 2.5.5.328052 Vulnerable!
2 app-emulation/vmware-workstation
<= 6.5.5.328052 Vulnerable!
3 app-emulation/vmware-server
<= 1.0.9.156507 Vulnerable!
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers. Please review the CVE identifiers referenced below for
details.
A remote attacker could entice a user to open a specially crafted file,
possibly resulting in the remote execution of arbitrary code, or a
Denial of Service. Remote attackers also may be able to spoof DNS
traffic, read arbitrary files, or inject arbitrary web script to the
VMware Server Console.
Furthermore, guest OS users may be able to execute arbitrary code on
the host OS, gain escalated privileges on the guest OS, or cause a
Denial of Service (crash the host OS).
Workaround
==========
There is no known workaround at this time. We recommend that users
unmerge VMware Server:
# emerge --unmerge "app-emulation/vmware-server"
References
==========
[ 1 ] CVE-2007-5269
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269
[ 2 ] CVE-2007-5503
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5503
[ 3 ] CVE-2007-5671
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5671
[ 4 ] CVE-2008-0967
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0967
[ 5 ] CVE-2008-1340
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1340
[ 6 ] CVE-2008-1361
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1361
[ 7 ] CVE-2008-1362
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1362
[ 8 ] CVE-2008-1363
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1363
[ 9 ] CVE-2008-1364
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1364
[ 10 ] CVE-2008-1392
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1392
[ 11 ] CVE-2008-1447
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1447
[ 12 ] CVE-2008-1806
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1806
[ 13 ] CVE-2008-1807
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1807
[ 14 ] CVE-2008-1808
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1808
[ 15 ] CVE-2008-2098
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2098
[ 16 ] CVE-2008-2100
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2100
[ 17 ] CVE-2008-2101
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2101
[ 18 ] CVE-2008-4915
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4915
[ 19 ] CVE-2008-4916
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4916
[ 20 ] CVE-2008-4917
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4917
[ 21 ] CVE-2009-0040
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0040
[ 22 ] CVE-2009-0909
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0909
[ 23 ] CVE-2009-0910
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0910
[ 24 ] CVE-2009-1244
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1244
[ 25 ] CVE-2009-2267
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2267
[ 26 ] CVE-2009-3707
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3707
[ 27 ] CVE-2009-3732
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3732
[ 28 ] CVE-2009-3733
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3733
[ 29 ] CVE-2009-4811
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4811
[ 30 ] CVE-2010-1137
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1137
[ 31 ] CVE-2010-1138
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1138
[ 32 ] CVE-2010-1139
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1139
[ 33 ] CVE-2010-1140
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1140
[ 34 ] CVE-2010-1141
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1141
[ 35 ] CVE-2010-1142
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1142
[ 36 ] CVE-2010-1143
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1143
[ 37 ] CVE-2011-3868
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3868
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-25.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
VMware Products Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA39206
VERIFY ADVISORY:
http://secunia.com/advisories/39206/
DESCRIPTION:
Some vulnerabilities have been reported in multiple VMware products,
which can be exploited by malicious, local users to disclose
sensitive information or gain escalated privileges, and by malicious
people to disclose sensitive information, cause a DoS (Denial of
Service), or potentially compromise a user's system.
NOTE: This vulnerability cannot be exploited without administrative
privileges on recent Windows versions (e.g. Windows XP and Windows
Vista).
3) An error in libpng can be exploited to disclose uninitialised
memory via a specially crafted image.
For more information:
SA35346
4) A boundary error and two integer truncation errors in the VMnc
codec can be exploited to potentially execute arbitrary code.
For more information:
SA36712
5) An error in the VMware Authorization Service ("vmware-authd") can
be exploited to cause a crash.
For more information:
SA39203
7) A format string error in "vmrun" can be exploited to potentially
gain escalated privileges.
For more information:
SA39201
SOLUTION:
Update to a fixed version.
PROVIDED AND/OR DISCOVERED BY:
4) Alin Rad Pop, Secunia Research
The vendor also credits:
1) Jure Skofic and Mitja Kolsek of ACROS Security
2) Thierry Zoller
4) iDefense and Sebastien Renaud of Vupen
6) Johann MacDonagh
7) Thomas Toth-Steiner
ORIGINAL ADVISORY:
VMware (VMSA-2010-0007):
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
Secunia Research:
http://secunia.com/secunia_research/2009-36/
http://secunia.com/secunia_research/2009-37/
OTHER REFERENCES:
SA35346:
http://secunia.com/advisories/35346/
SA36712:
http://secunia.com/advisories/36712/
SA36988:
http://secunia.com/advisories/36988/
SA39198:
http://secunia.com/advisories/39198/
SA39201:
http://secunia.com/advisories/39201/
SA39203:
http://secunia.com/advisories/39203/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201004-0988 | CVE-2010-1142 | VMWare Tools Package Local Privilege Escalation Vulnerability |
CVSS V2: 8.5 CVSS V3: - Severity: HIGH |
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x before 2.0.2 build 203138; VMware Fusion 2.x before 2.0.6 build 246742; VMware ESXi 3.5 and 4.0; and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0 does not properly load VMware programs, which might allow Windows guest OS users to gain privileges by placing a Trojan horse program at an unspecified location on the guest OS disk. plural VMware Product VMware Tools Is VMware There is a vulnerability in which privileges can be obtained due to a flaw in processing related to program loading.plural VMware Product VMware Tools Is VMware There is a vulnerability in which privileges can be obtained due to a flaw in processing related to program loading. VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. All guest operating system users on Windows platforms can gain privilege escalation by placing Trojans on the guest system's disks. On recent versions of Windows, only users with administrative privileges can successfully perform an attack. Multiple VMware products are prone to a local privilege-escalation vulnerability.
Local attackers can exploit this issue to execute arbitrary code with elevated privileges; this may aid in other attacks.
NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities), but has been given its own record to better document it.
Please see the vendor's advisory for more information. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2010-0007
Synopsis: VMware hosted products, vCenter Server and ESX
patches resolve multiple security issues
Issue date: 2010-04-09
Updated on: 2010-04-09 (initial release of advisory)
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042
CVE-2009-1564 CVE-2009-1565 CVE-2009-3732
CVE-2009-3707 CVE-2010-1138 CVE-2010-1139
CVE-2010-1141
- -------------------------------------------------------------------------
1.
2.
Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan
to upgrade to at least ESX 3.0.3 and preferably to the newest
release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.
End of General Support for VMware Workstation 6.x is 2011-04-27,
users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users
should plan to upgrade to the newest release of either ESXi or
VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users
should plan to upgrade to the newest release of vCenter Server.
3. Problem Description
a. Windows-based VMware Tools Unsafe Library Loading vulnerability
A vulnerability in the way VMware libraries are referenced allows
for arbitrary code execution in the context of the logged on user.
In order for an attacker to exploit the vulnerability, the attacker
would need to lure the user that is logged on a Windows Guest
Operating System to click on the attacker's file on a network
share. This file could be in any file format. The attacker will
need to have the ability to host their malicious files on a
network share.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
Steps needed to remediate this vulnerability:
Guest systems on VMware Workstation, Player, ACE, Server, Fusion
- Install the remediated version of Workstation, Player, ACE,
Server and Fusion.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details. Windows-based VMware Tools Arbitrary Code Execution vulnerability
A vulnerability in the way VMware executables are loaded allows for
arbitrary code execution in the context of the logged on user.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the Virtual Machine of the user. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c. Windows-based VMware Workstation and Player host privilege
escalation
A vulnerability in the USB service allows for a privilege
escalation. A local attacker on the host of a Windows-based
Operating System where VMware Workstation or VMware Player
is installed could plant a malicious executable on the host and
elevate their privileges.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x any not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.0 Linux not affected
Player 2.5.x any not affected
Ace any any not affected
Server 2.x any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
d. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. VMware VMnc Codec heap overflow vulnerabilities
The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.
Vulnerabilities in the decoder allow for execution of arbitrary
code with the privileges of the user running an application
utilizing the vulnerable codec.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Movie Decoder any Windows 6.5.4 Build 246459 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.x any not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
ACE any any not affected
Server 2.x Window not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
f.
For an attack to be successful, an attacker would need to trick the
VMrc user into opening a malicious Web page or following a malicious
URL. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Potential information leak via hosted networking stack
A vulnerability in the virtual networking stack of VMware hosted
products could allow host information disclosure.
A guest operating system could send memory from the host vmware-vmx
process to the virtual network adapter and potentially to the
host's physical Ethernet wire.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Linux-based vmrun format string vulnerability
A format string vulnerability in vmrun could allow arbitrary code
execution.
If a vmrun command is issued and processes are listed, code could
be executed in the context of the user listing the processes.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
VIX API any Windows not affected
VIX API 1.6.x Linux upgrade to VIX API 1.7 or later
VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows not affected
Workstation 6.5.x Linux 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x Windows not affected
Player 2.5.x Linux 2.5.4 build 246459 or later
Ace any Windows not affected
Server 2.x Windows not affected
Server 2.x Linux not being fixed at this time
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
4. Solution
Please review the patch/release notes for your product and version
and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
--------------------------------------------------
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe
md5sum: ea2ac5907ae4c5c323147fe155443ab8
sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools
md5sum: a896f7aaedde8799f21b52b89f5fc9ef
sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools
md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874
sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools
md5sum: 808682eaa6b202fa29172821f7378768
sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools
md5sum: 5116e27e7b13a76693402577bd9fda58
sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit
Linux 32-bit .rpm
md5sum: 9efb43a604d50e541eb3be7081b8b198
sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit
Linux 32-bit .bundle
md5sum: 38760682ad3b2f6bfb4e40f424c95c2a
sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit
Linux 64-bit .rpm
md5sum: 24311492bc515e9bc98eff9b2e7d33a2
sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit
Linux 64-bit .bundle
md5sum: ed24296705ad48442549d9cb2b3c0d8d
sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
-------------------
http://downloads.vmware.com/tryvmware/?p=player&lp=default
Release notes:
http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit
md5sum: 78c92c0242c9540f68a629d4ac49c516
sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle)
md5sum: e7cd19d39c7bbd1aee582743d76a7863
sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle)
md5sum: 88b08537c6eea705883dc1755b97738c
sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit
md5sum: 2c46fc7e2516f331eb4dd23154d00a54
sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux
md5sum: 8b0994a26363246b5e954f97bd5a088d
sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux
md5sum: ef7b9890c52b1e333f2357760a7fff85
sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
-------------------
http://downloads.vmware.com/download/player/player_reg.html
Release notes:
http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe)
md5sum: 531140a1eeed7d8b71f726b3d32a9174
sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm)
md5sum: 1905f61af490f9760bef54450747e708
sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle)
md5sum: 74f539005687a4efce7971f7ef019af5
sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm)
md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39
sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle)
md5sum: 175ce2f9656ff10a1327c0d48f80c65f
sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN
Release notes:
http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance
md5sum: e26d258c511572064e99774fbac9184c
sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows
md5sum: e970828f2a5a62ac108879033a70f4b6
sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9
md5sum: 59b3ad5964daef2844e72fd1765590fc
sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4
md5sum: 6623f6a8a645402a1c8c351ec99a1889
sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN
Release notes:
http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance
AMS Virtual Appliance .zip
md5sum: 3935f23d4a074e7a3429a1c80cfd2155
sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows
Windows .exe
md5sum: 1173bd7da6ed330a262ed4e2eff6562c
sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9
SLES 9 .rpm
md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208
sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4
RHEL 4 .rpm
md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5
sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2
Version 2.0.2 | 203138 - 10/26/09
507 MB EXE image VMware Server 2 for Windows Operating Systems. A
master installer file containing all Windows components of VMware
Server.
md5sum: a6430bcc16ff7b3a29bb8da1704fc38a
sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b
VIX API 1.6 for Windows
Version 2.0.2 | 203138 - 10/26/09
37 MB image
md5sum: 827e65e70803ec65ade62dd27a74407a
sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22
For Linux
VMware Server 2 for Linux Operating Systems.
Version 2.0.2 | 203138 - 10/26/09
37 MB TAR image
md5sum: 95ddea5a0579a35887bd15b083ffea20
sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
452 MB RPM image
md5sum: 35c8b176601133749e4055e0034f8be6
sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
451 MB TAR image
md5sum: cc7aef813008eeb7150c21547d431b39
sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474
VMware Fusion 3.0.2
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302
Release notes:
http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html
VMware Fusion 3.0.2 (for Intel-based Macs)
md5sum: aa17278a4a668eeb9f9467e4e3111ccc
sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3
VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs)
md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896
sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01
VMware Fusion 2.0.7
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207
Release notes:
http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html
VMware Fusion 2.0.7 (for Intel-based Macs)
md5sum: a293f5ce6ccc227760640753386e9da6
sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370
VMware Fusion 2.0.7 Light (for Intel-based Macs)
md5sum: d4772d118fb90323f598849e70c21189
sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77
VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713
----------------------------------------------
VIX API for Window 32-bit and 64-bit
Main installation file for Windows 32-bit and 64-bit host
md5sum:b494fc3092f07d0f29cc06a19fe61306
sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9
VIX API for Linux 32-bit
md5sum:6b0ed8872d8b714363cddc68b6a77008
sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1
VIX API for Linux 64-bit
md5sum:d57aa9f98058d5a386c18e14cc05bf4d
sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b
VIX API Version: 1.8.1 | 2009-10-11 | 207905
---------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:4f21e4cb518767bc08045f5a39f5d41f
sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12
VIX API for Linux 32-bit
md5sum:f347e94d907c26754540d59956ee5d53
sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907
VIX API for Linux 64-bit
md5sum:b8a3982072d0d42c0c37dd7eb49d686c
sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8
VIX API Version: 1.10 Beta | 01/28/10 | 222403
----------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:ac5b6e9197cb68c302bfac9ed683e3af
sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73
VIX API for Linux 32-bit
md5sum:07d1989d042e317eb9d2b3daf269dda7
sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c
VIX API for Linux 64-bit
md5sum:9b345008e0adec3c044988307294944b
sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b
ESXi
----
ESXi 4.0 bulletin ESXi400-201002402-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip
md5sum: e5aa2968d389594abdc59cbac7b0183d
sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2
http://kb.vmware.com/kb/1018404
ESXi 3.5
--------
ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in
ESXe350-200912401-O-BG from December 2009.
The same patch, ESXe350-200912402-T-BG, is also contained in
ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also
included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update)
http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the
VI Client "C" are contained in a single offline "O" download file.
ESX
---
ESX 4.0 bulletin ESX400-201002401-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip
md5sum: de62cbccaffa4b2b6831617f18c1ccb4
sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab
http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix,
ESX400-201002401-BG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip
md5sum: 99c1fcafbf0ca105ce73840d686e9914
sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb
http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix,
ESX400-200911223-UG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG
http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip
md5sum: f1d3589745b4ae933554785aef22bacc
sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47
http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG
http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip
md5sum: 49ee56b687707cbe6999836c315f081a
http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15
http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz
md5sum: c346fe510b6e51145570e03083f77357
sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4
http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
5. References
http://www.acrossecurity.com/advisories.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
6. Change log
2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion
2.0.7 on 2010-04-08.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT
d58bjKG6Ic7m/TsoJP4M2tw=
=Q1zv
-----END PGP SIGNATURE-----
.
Background
==========
VMware Player, Server, and Workstation allow emulation of a complete PC
on a PC without the usual performance overhead of most emulators.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-emulation/vmware-player
<= 2.5.5.328052 Vulnerable!
2 app-emulation/vmware-workstation
<= 6.5.5.328052 Vulnerable!
3 app-emulation/vmware-server
<= 1.0.9.156507 Vulnerable!
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers. Please review the CVE identifiers referenced below for
details.
A remote attacker could entice a user to open a specially crafted file,
possibly resulting in the remote execution of arbitrary code, or a
Denial of Service. Remote attackers also may be able to spoof DNS
traffic, read arbitrary files, or inject arbitrary web script to the
VMware Server Console.
Furthermore, guest OS users may be able to execute arbitrary code on
the host OS, gain escalated privileges on the guest OS, or cause a
Denial of Service (crash the host OS).
Workaround
==========
There is no known workaround at this time. We recommend that users
unmerge VMware Server:
# emerge --unmerge "app-emulation/vmware-server"
References
==========
[ 1 ] CVE-2007-5269
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269
[ 2 ] CVE-2007-5503
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5503
[ 3 ] CVE-2007-5671
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5671
[ 4 ] CVE-2008-0967
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0967
[ 5 ] CVE-2008-1340
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1340
[ 6 ] CVE-2008-1361
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1361
[ 7 ] CVE-2008-1362
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1362
[ 8 ] CVE-2008-1363
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1363
[ 9 ] CVE-2008-1364
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1364
[ 10 ] CVE-2008-1392
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1392
[ 11 ] CVE-2008-1447
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1447
[ 12 ] CVE-2008-1806
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1806
[ 13 ] CVE-2008-1807
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1807
[ 14 ] CVE-2008-1808
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1808
[ 15 ] CVE-2008-2098
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2098
[ 16 ] CVE-2008-2100
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2100
[ 17 ] CVE-2008-2101
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2101
[ 18 ] CVE-2008-4915
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4915
[ 19 ] CVE-2008-4916
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4916
[ 20 ] CVE-2008-4917
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4917
[ 21 ] CVE-2009-0040
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0040
[ 22 ] CVE-2009-0909
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0909
[ 23 ] CVE-2009-0910
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0910
[ 24 ] CVE-2009-1244
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1244
[ 25 ] CVE-2009-2267
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2267
[ 26 ] CVE-2009-3707
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3707
[ 27 ] CVE-2009-3732
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3732
[ 28 ] CVE-2009-3733
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3733
[ 29 ] CVE-2009-4811
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4811
[ 30 ] CVE-2010-1137
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1137
[ 31 ] CVE-2010-1138
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1138
[ 32 ] CVE-2010-1139
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1139
[ 33 ] CVE-2010-1140
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1140
[ 34 ] CVE-2010-1141
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1141
[ 35 ] CVE-2010-1142
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1142
[ 36 ] CVE-2010-1143
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1143
[ 37 ] CVE-2011-3868
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3868
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-25.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
VMware Products Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA39206
VERIFY ADVISORY:
http://secunia.com/advisories/39206/
DESCRIPTION:
Some vulnerabilities have been reported in multiple VMware products,
which can be exploited by malicious, local users to disclose
sensitive information or gain escalated privileges, and by malicious
people to disclose sensitive information, cause a DoS (Denial of
Service), or potentially compromise a user's system. Windows XP and Windows
Vista).
3) An error in libpng can be exploited to disclose uninitialised
memory via a specially crafted image.
For more information:
SA35346
4) A boundary error and two integer truncation errors in the VMnc
codec can be exploited to potentially execute arbitrary code.
For more information:
SA36712
5) An error in the VMware Authorization Service ("vmware-authd") can
be exploited to cause a crash.
For more information:
SA39203
7) A format string error in "vmrun" can be exploited to potentially
gain escalated privileges.
For more information:
SA39201
SOLUTION:
Update to a fixed version.
PROVIDED AND/OR DISCOVERED BY:
4) Alin Rad Pop, Secunia Research
The vendor also credits:
1) Jure Skofic and Mitja Kolsek of ACROS Security
2) Thierry Zoller
4) iDefense and Sebastien Renaud of Vupen
6) Johann MacDonagh
7) Thomas Toth-Steiner
ORIGINAL ADVISORY:
VMware (VMSA-2010-0007):
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
Secunia Research:
http://secunia.com/secunia_research/2009-36/
http://secunia.com/secunia_research/2009-37/
OTHER REFERENCES:
SA35346:
http://secunia.com/advisories/35346/
SA36712:
http://secunia.com/advisories/36712/
SA36988:
http://secunia.com/advisories/36988/
SA39198:
http://secunia.com/advisories/39198/
SA39201:
http://secunia.com/advisories/39201/
SA39203:
http://secunia.com/advisories/39203/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201004-1006 | CVE-2009-1564 | VMware VMnc Codec HexTile Coded Video Block Parsing Heap Overflow Vulnerability |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Heap-based buffer overflow in vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted video chunks that use HexTile encoding. VMWare is a virtual PC software that allows two or more Windows, DOS, and LINUX systems to run simultaneously on a single machine. The vmnc.dll library lacks input checking when processing HexTile encoded video blocks. The user is tricked into opening a malformed AVI file to trigger a heap overflow, causing arbitrary code execution. Multiple VMware products are prone to a heap-based buffer-overflow vulnerability.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote Vulnerabilities) but has been assigned its own record to better document it. VMware's enterprise
software, VMware ESX Server, runs directly on server hardware
without requiring an additional underlying operating system".
from wikipedia
II.
III. Binary Analysis & Proof-fo-concept
---------------------------------------
In-depth binary analysis of the vulnerability and a PoC
have been released by VUPEN through the VUPEN Binary Analysis
& Exploits Service :
http://www.vupen.com/exploits/
V. CREDIT
--------------
The vulnerability was discovered by Sebastien Renaud of VUPEN Security
VII. ABOUT VUPEN Security
---------------------------
VUPEN is a leading IT security research company providing vulnerability
management and security intelligence solutions which enable enterprises
and institutions to eliminate vulnerabilities before they can be exploited,
ensure security policy compliance and meaningfully measure and manage risks.
Governmental and federal agencies, and global enterprises in the financial
services, insurance, manufacturing and technology industries rely on VUPEN
to improve their security, prioritize resources, cut time and costs, and
stay ahead of the latest threats.
* VUPEN Vulnerability Notification Service:
http://www.vupen.com/english/services/
* VUPEN Binary Analysis & Exploits Service :
http://www.vupen.com/exploits/
VIII. DISCLOSURE TIMELINE
-----------------------------------
2009-09-14 - Vendor notified
2009-09-14 - Vendor response
2009-10-09 - Status update received
2009-10-27 - Status update received
2010-01-29 - Status update received
2010-03-05 - Status update received
2010-03-31 - Status update received
2010-04-09 - Coordinated public Disclosure
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2010-0007
Synopsis: VMware hosted products, vCenter Server and ESX
patches resolve multiple security issues
Issue date: 2010-04-09
Updated on: 2010-04-09 (initial release of advisory)
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042
CVE-2009-1564 CVE-2009-1565 CVE-2009-3732
CVE-2009-3707 CVE-2010-1138 CVE-2010-1139
CVE-2010-1141
- -------------------------------------------------------------------------
1.
2.
Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan
to upgrade to at least ESX 3.0.3 and preferably to the newest
release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.
End of General Support for VMware Workstation 6.x is 2011-04-27,
users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users
should plan to upgrade to the newest release of either ESXi or
VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users
should plan to upgrade to the newest release of vCenter Server.
3. Problem Description
a. Windows-based VMware Tools Unsafe Library Loading vulnerability
A vulnerability in the way VMware libraries are referenced allows
for arbitrary code execution in the context of the logged on user.
This vulnerability is present only on Windows Guest Operating
Systems.
In order for an attacker to exploit the vulnerability, the attacker
would need to lure the user that is logged on a Windows Guest
Operating System to click on the attacker's file on a network
share. This file could be in any file format. The attacker will
need to have the ability to host their malicious files on a
network share.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
Steps needed to remediate this vulnerability:
Guest systems on VMware Workstation, Player, ACE, Server, Fusion
- Install the remediated version of Workstation, Player, ACE,
Server and Fusion.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.x any not affected
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x any 2.5.4 build 246459 or later
ACE 2.6.x Windows not affected
ACE 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any 2.0.2 build 203138 or later
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.6 build 246742 or later
ESXi 4.0 ESXi ESXi400-201002402-BG
ESXi 3.5 ESXi ESXe350-200912401-T-BG or later
ESX 4.0 ESX ESX400-201002401-BG
ESX 3.5 ESX ESX350-200912401-BG
ESX 3.0.3 ESX ESX303-201002203-UG
ESX 2.5.5 ESX Upgrade Patch 15
b. This
vulnerability is present only on Windows Guest Operating Systems.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the Virtual Machine of the user. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c. Windows-based VMware Workstation and Player host privilege
escalation
A vulnerability in the USB service allows for a privilege
escalation. A local attacker on the host of a Windows-based
Operating System where VMware Workstation or VMware Player
is installed could plant a malicious executable on the host and
elevate their privileges.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x any not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.0 Linux not affected
Player 2.5.x any not affected
Ace any any not affected
Server 2.x any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
d. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not applicable
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x any 2.5.4 build 246459 or later
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion any any Mac OS/X not affected
ESXi any ESXi not applicable
ESX any ESX not applicable
e.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Movie Decoder any Windows 6.5.4 Build 246459 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.x any not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
ACE any any not affected
Server 2.x Window not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
f. VMware Remote Console format string vulnerability
VMware Remote Console (VMrc) contains a format string vulnerability.
For an attack to be successful, an attacker would need to trick the
VMrc user into opening a malicious Web page or following a malicious
URL. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.x Linux not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x Windows not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any any not affected
ESX any any not affected
h. Potential information leak via hosted networking stack
A vulnerability in the virtual networking stack of VMware hosted
products could allow host information disclosure.
A guest operating system could send memory from the host vmware-vmx
process to the virtual network adapter and potentially to the
host's physical Ethernet wire.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion 3.0 Mac OS/X 3.0.1 build 232708 or later
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
i. Linux-based vmrun format string vulnerability
A format string vulnerability in vmrun could allow arbitrary code
execution.
If a vmrun command is issued and processes are listed, code could
be executed in the context of the user listing the processes.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
VIX API any Windows not affected
VIX API 1.6.x Linux upgrade to VIX API 1.7 or later
VIX API 1.6.x Linux64 upgrade to VIX API 1.7 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows not affected
Workstation 6.5.x Linux 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x Windows not affected
Player 2.5.x Linux 2.5.4 build 246459 or later
Ace any Windows not affected
Server 2.x Windows not affected
Server 2.x Linux not being fixed at this time
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
4. Solution
Please review the patch/release notes for your product and version
and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
--------------------------------------------------
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe
md5sum: ea2ac5907ae4c5c323147fe155443ab8
sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools
md5sum: a896f7aaedde8799f21b52b89f5fc9ef
sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools
md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874
sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools
md5sum: 808682eaa6b202fa29172821f7378768
sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools
md5sum: 5116e27e7b13a76693402577bd9fda58
sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit
Linux 32-bit .rpm
md5sum: 9efb43a604d50e541eb3be7081b8b198
sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit
Linux 32-bit .bundle
md5sum: 38760682ad3b2f6bfb4e40f424c95c2a
sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit
Linux 64-bit .rpm
md5sum: 24311492bc515e9bc98eff9b2e7d33a2
sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit
Linux 64-bit .bundle
md5sum: ed24296705ad48442549d9cb2b3c0d8d
sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
-------------------
http://downloads.vmware.com/tryvmware/?p=player&lp=default
Release notes:
http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit
md5sum: 78c92c0242c9540f68a629d4ac49c516
sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle)
md5sum: e7cd19d39c7bbd1aee582743d76a7863
sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle)
md5sum: 88b08537c6eea705883dc1755b97738c
sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit
md5sum: 2c46fc7e2516f331eb4dd23154d00a54
sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux
md5sum: 8b0994a26363246b5e954f97bd5a088d
sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux
md5sum: ef7b9890c52b1e333f2357760a7fff85
sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
-------------------
http://downloads.vmware.com/download/player/player_reg.html
Release notes:
http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe)
md5sum: 531140a1eeed7d8b71f726b3d32a9174
sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm)
md5sum: 1905f61af490f9760bef54450747e708
sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle)
md5sum: 74f539005687a4efce7971f7ef019af5
sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm)
md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39
sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle)
md5sum: 175ce2f9656ff10a1327c0d48f80c65f
sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN
Release notes:
http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance
md5sum: e26d258c511572064e99774fbac9184c
sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows
md5sum: e970828f2a5a62ac108879033a70f4b6
sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9
md5sum: 59b3ad5964daef2844e72fd1765590fc
sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4
md5sum: 6623f6a8a645402a1c8c351ec99a1889
sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN
Release notes:
http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance
AMS Virtual Appliance .zip
md5sum: 3935f23d4a074e7a3429a1c80cfd2155
sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows
Windows .exe
md5sum: 1173bd7da6ed330a262ed4e2eff6562c
sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9
SLES 9 .rpm
md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208
sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4
RHEL 4 .rpm
md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5
sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2
Version 2.0.2 | 203138 - 10/26/09
507 MB EXE image VMware Server 2 for Windows Operating Systems. A
master installer file containing all Windows components of VMware
Server.
md5sum: a6430bcc16ff7b3a29bb8da1704fc38a
sha1sum: 39683e7333732cf879ff0b34f66e693dde0e340b
VIX API 1.6 for Windows
Version 2.0.2 | 203138 - 10/26/09
37 MB image
md5sum: 827e65e70803ec65ade62dd27a74407a
sha1sum: a14281bc055271a19be3c88026e92304bc3f0e22
For Linux
VMware Server 2 for Linux Operating Systems.
Version 2.0.2 | 203138 - 10/26/09
37 MB TAR image
md5sum: 95ddea5a0579a35887bd15b083ffea20
sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
452 MB RPM image
md5sum: 35c8b176601133749e4055e0034f8be6
sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
451 MB TAR image
md5sum: cc7aef813008eeb7150c21547d431b39
sha1sum: b65d3d46dc947fc7995bda354c4947afabd23474
VMware Fusion 3.0.2
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-302
Release notes:
http://downloads.vmware.com/support/fusion3/doc/releasenotes_fusion_302.html
VMware Fusion 3.0.2 (for Intel-based Macs)
md5sum: aa17278a4a668eeb9f9467e4e3111ccc
sha1sum: 58c3d63705ac90839f7c1ae14264177e1fd56df3
VMware Fusion 3.0.2 Light for Mac (for Intel-based Macs)
md5sum: 052ecbbfc4f59a85e2d08b4bd3ef0896
sha1sum: 61e00487f4c649588099647d4a5f47ddf5b8ad01
VMware Fusion 2.0.7
-------------------
http://downloads.vmware.com/download/download.do?downloadGroup=FUS-207
Release notes:
http://downloads.vmware.com/support/fusion2/doc/releasenotes_fusion_207.html
VMware Fusion 2.0.7 (for Intel-based Macs)
md5sum: a293f5ce6ccc227760640753386e9da6
sha1sum: ddfda92f9baf30e536bc485e42325d173a1aa370
VMware Fusion 2.0.7 Light (for Intel-based Macs)
md5sum: d4772d118fb90323f598849e70c21189
sha1sum: 5c1df1597e77ebe0f0555749b281008ca5f2fb77
VIX API 1.7 Version: 1.7 | 2009-08-26 | 186713
----------------------------------------------
VIX API for Window 32-bit and 64-bit
Main installation file for Windows 32-bit and 64-bit host
md5sum:b494fc3092f07d0f29cc06a19fe61306
sha1sum:aa8638424cb7f25c1e42343134ac9f0bd2c2e0c9
VIX API for Linux 32-bit
md5sum:6b0ed8872d8b714363cddc68b6a77008
sha1sum:8a9b12a61641394b347488119a7120eaa47dc2a1
VIX API for Linux 64-bit
md5sum:d57aa9f98058d5a386c18e14cc05bf4d
sha1sum:3b7d4461ea257e795b322cc080f4ae29a230666b
VIX API Version: 1.8.1 | 2009-10-11 | 207905
---------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:4f21e4cb518767bc08045f5a39f5d41f
sha1sum:5b8275c549f9d9498bd2ed078557f1ce1986ac12
VIX API for Linux 32-bit
md5sum:f347e94d907c26754540d59956ee5d53
sha1sum:6ddc6c9371ba127d04bc83bd55988a6c83366907
VIX API for Linux 64-bit
md5sum:b8a3982072d0d42c0c37dd7eb49d686c
sha1sum:d044ac3dd42f806bc4ff48ddf584b5e3d82910c8
VIX API Version: 1.10 Beta | 01/28/10 | 222403
----------------------------------------------
VIX API for Windows 32-bit and 64-bit
md5sum:ac5b6e9197cb68c302bfac9ed683e3af
sha1sum:0d942e7409e88e684bdb65811e7be7f47d631a73
VIX API for Linux 32-bit
md5sum:07d1989d042e317eb9d2b3daf269dda7
sha1sum:1e3840d426d7dfff53fa7e1bd22b09b56cf2362c
VIX API for Linux 64-bit
md5sum:9b345008e0adec3c044988307294944b
sha1sum:7a54a893369c2227f7e8058430c40983168c6e0b
ESXi
----
ESXi 4.0 bulletin ESXi400-201002402-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-193-20100228-731251/ESXi400-201002001.zip
md5sum: e5aa2968d389594abdc59cbac7b0183d
sha1sum: bb50b3ad7934e3f9e24edc879b35e83b357343b2
http://kb.vmware.com/kb/1018404
ESXi 3.5
--------
ESXi 3.5 patch ESXe350-200912402-T-BG was first contained in
ESXe350-200912401-O-BG from December 2009.
The same patch, ESXe350-200912402-T-BG, is also contained in
ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also
included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update)
http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the
VI Client "C" are contained in a single offline "O" download file.
ESX
---
ESX 4.0 bulletin ESX400-201002401-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip
md5sum: de62cbccaffa4b2b6831617f18c1ccb4
sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab
http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix,
ESX400-201002401-BG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip
md5sum: 99c1fcafbf0ca105ce73840d686e9914
sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb
http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix,
ESX400-200911223-UG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG
http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip
md5sum: f1d3589745b4ae933554785aef22bacc
sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47
http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG
http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip
md5sum: 49ee56b687707cbe6999836c315f081a
http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15
http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz
md5sum: c346fe510b6e51145570e03083f77357
sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4
http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
5. References
http://www.acrossecurity.com/advisories.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
6. Change log
2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion
2.0.7 on 2010-04-08.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT
d58bjKG6Ic7m/TsoJP4M2tw=
=Q1zv
-----END PGP SIGNATURE-----
.
NOTE: Other products and versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: Remote
======================================================================
3) Vendor's Description of Software
"VMware Workstation makes it simple to create and run multiple virtual
machines on your desktop or laptop computer.
The vulnerability is caused by a boundary error in vmnc.dll when
processing HexTile encoded video chunks and can be exploited to cause
a heap-based buffer overflow.
======================================================================
6) Time Table
14/09/2009 - Vendor notified.
14/09/2009 - Vendor response.
09/04/2010 - Public disclosure.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2009-36/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
VAR-201004-0982 | CVE-2010-1139 | VMWare VIX API vmrun Tool Format String Vulnerability |
CVSS V2: 7.2 CVSS V3: - Severity: HIGH |
Format string vulnerability in vmrun in VMware VIX API 1.6.x, VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Linux, and VMware Fusion 2.x before 2.0.7 build 246742, allows local users to gain privileges via format string specifiers in process metadata. When the vmrun tool lists processes, it will cause arbitrary code to be executed with elevated privileges. Multiple VMware products are prone to a local privilege-escalation vulnerability.
NOTE: This issue was previously covered in BID 39345 (VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities), but has been given its own record to better document it.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Thomas Toth-Steiner. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
VMware Security Advisory
Advisory ID: VMSA-2010-0007
Synopsis: VMware hosted products, vCenter Server and ESX
patches resolve multiple security issues
Issue date: 2010-04-09
Updated on: 2010-04-09 (initial release of advisory)
CVE numbers: CVE-2010-1142 CVE-2010-1140 CVE-2009-2042
CVE-2009-1564 CVE-2009-1565 CVE-2009-3732
CVE-2009-3707 CVE-2010-1138 CVE-2010-1139
CVE-2010-1141
- -------------------------------------------------------------------------
1.
2.
Notes:
Effective May 2010, VMware's patch and update release program during
Extended Support will be continued with the condition that all
subsequent patch and update releases will be based on the latest
baseline release version as of May 2010 (i.e. ESX 3.0.3 Update 1,
ESX 3.5 Update 5, and VirtualCenter 2.5 Update 6). Refer to section
"End of Product Availability FAQs" at
http://www.vmware.com/support/policies/lifecycle/vi/faq.html for
details.
Extended support for ESX 2.5.5 ends on 2010-06-15. Users should plan
to upgrade to at least ESX 3.0.3 and preferably to the newest
release available.
Extended support for ESX 3.0.3 ends on 2011-12-10. Users should plan
to upgrade to at least ESX 3.5 and preferably to the newest release
available.
End of General Support for VMware Workstation 6.x is 2011-04-27,
users should plan to upgrade to the newest release available.
End of General Support for VMware Server 2.0 is 2011-06-30, users
should plan to upgrade to the newest release of either ESXi or
VMware Player.
Extended support for Virtual Center 2.0.2 is 2011-12-10, users
should plan to upgrade to the newest release of vCenter Server.
3. Problem Description
a. Windows-based VMware Tools Unsafe Library Loading vulnerability
A vulnerability in the way VMware libraries are referenced allows
for arbitrary code execution in the context of the logged on user.
This vulnerability is present only on Windows Guest Operating
Systems.
In order for an attacker to exploit the vulnerability, the attacker
would need to lure the user that is logged on a Windows Guest
Operating System to click on the attacker's file on a network
share. This file could be in any file format. The attacker will
need to have the ability to host their malicious files on a
network share.
VMware would like to thank Jure Skofic and Mitja Kolsek of ACROS
Security (http://www.acrossecurity.com) for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1141 to this issue.
- Upgrade tools in the virtual machine (virtual machine users
will be prompted to upgrade).
Guest systems on ESX 4.0, 3.5, 3.0.3, 2.5.5, ESXi 4.0, 3.5
- Install the relevant patches (see below for patch identifiers)
- Manually upgrade tools in the virtual machine (virtual machine
users will not be prompted to upgrade). Note the VI Client will
not show the VMware tools is out of date in the summary tab.
Please see http://tinyurl.com/27mpjo page 80 for details.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. See above for remediation
details.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.x any not affected
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.x any not affected
Player 2.5.x any 2.5.4 build 246459 or later
ACE 2.6.x Windows not affected
ACE 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any 2.0.2 build 203138 or later
Fusion 3.x Mac OS/X not affected
Fusion 2.x Mac OS/X 2.0.6 build 246742 or later
ESXi 4.0 ESXi ESXi400-201002402-BG
ESXi 3.5 ESXi ESXe350-200912401-T-BG or later
ESX 4.0 ESX ESX400-201002401-BG
ESX 3.5 ESX ESX350-200912401-BG
ESX 3.0.3 ESX ESX303-201002203-UG
ESX 2.5.5 ESX Upgrade Patch 15
b. Windows-based VMware Tools Arbitrary Code Execution vulnerability
A vulnerability in the way VMware executables are loaded allows for
arbitrary code execution in the context of the logged on user. This
vulnerability is present only on Windows Guest Operating Systems.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the Virtual Machine of the user. On most
recent versions of Windows (XP, Vista) the attacker would need to
have administrator privileges to plant the malicious executable in
the right location.
Steps needed to remediate this vulnerability: See section 3.a.
VMware would like to thank Mitja Kolsek of ACROS Security
(http://www.acrossecurity.com) for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1142 to this issue.
Refer to the previous table in section 3.a for what action
remediates the vulnerability (column 4) if a solution is
available. See above for remediation details.
c. Windows-based VMware Workstation and Player host privilege
escalation
A vulnerability in the USB service allows for a privilege
escalation. A local attacker on the host of a Windows-based
Operating System where VMware Workstation or VMware Player
is installed could plant a malicious executable on the host and
elevate their privileges.
In order for an attacker to exploit the vulnerability, the attacker
would need to be able to plant their malicious executable in a
certain location on the host machine. On most recent versions of
Windows (XP, Vista) the attacker would need to have administrator
privileges to plant the malicious executable in the right location.
VMware would like to thank Thierry Zoller for reporting this issue
to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-1140 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x any not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.0 Linux not affected
Player 2.5.x any not affected
Ace any any not affected
Server 2.x any not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
d. Third party library update for libpng to version 1.2.37
The libpng libraries through 1.2.35 contain an uninitialized-
memory-read bug that may have security implications.
Specifically, 1-bit (2-color) interlaced images whose widths are
not divisible by 8 may result in several uninitialized bits at the
end of certain rows in certain interlace passes being returned to
the user. An application that failed to mask these out-of-bounds
pixels might display or process them, albeit presumably with benign
results in most cases.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-2042 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not applicable
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x any 6.5.4 build 246459 or later
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x any 2.5.4 build 246459 or later
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion any any Mac OS/X not affected
ESXi any ESXi not applicable
ESX any ESX not applicable
e. VMware VMnc Codec heap overflow vulnerabilities
The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.
For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2009-1564 and CVE-2009-1565 to these
issues.
VMware would like to thank iDefense, Sebastien Renaud of VUPEN
Vulnerability Research Team (http://www.vupen.com) and Alin Rad Pop
of Secunia Research for reporting these issues to us.
To remediate the above issues either install the stand alone movie
decoder or update your product using the table below.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Movie Decoder any Windows 6.5.4 Build 246459 or later
Workstation 7.x any not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.x any not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
ACE any any not affected
Server 2.x Window not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any ESXi not affected
ESX any ESX not affected
f.
Exploitation of this issue may lead to arbitrary code execution on
the system where VMrc is installed.
For an attack to be successful, an attacker would need to trick the
VMrc user into opening a malicious Web page or following a malicious
URL. Code execution would be at the privilege level of the user.
VMrc is present on a system if the VMrc browser plug-in has been
installed. This plug-in is required when using the console feature in
WebAccess. Installation of the plug-in follows after visiting the
console tab in WebAccess and choosing "Install plug-in". The plug-
in can only be installed on Internet Explorer and Firefox.
Under the following two conditions your version of VMrc is likely
to be affected:
- the VMrc plug-in was obtained from vCenter 4.0 or from ESX 4.0
without patch ESX400-200911223-UG and
- VMrc is installed on a Windows-based system
The following steps allow you to determine if you have an affected
version of VMrc installed:
- Locate the VMrc executable vmware-vmrc.exe on your Windows-based
system
- Right click and go to Properties
- Go to the tab "Versions"
- Click "File Version" in the "Item Name" window
- If the "Value" window shows "e.x.p build-158248", the version of
VMrc is affected
Remediation of this issue on Windows-based systems requires the
following steps (Linux-based systems are not affected):
- Uninstall affected versions of VMrc from the systems where the
VMrc plug-in has been installed (use the Windows Add/Remove
Programs interface)
- Install vCenter 4.0 Update 1 or install the ESX 4.0 patch
ESX400-200911223-UG
- Login into vCenter 4.0 Update 1 or ESX 4.0 with patch
ESX400-200911223-UG using WebAccess on the system where the VMrc
needs to be re-installed
- Re-install VMrc by going to the console tab in WebAccess. The
Console tab is selectable after selecting a virtual machine.
Note: the VMrc plug-in for Firefox on Windows-based operating
systems is no longer compatible after the above remediation steps.
Users are advised to use the Internet Explorer VMrc plug-in.
VMware would like to thank Alexey Sintsov from Digital Security
Research Group for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2009-3732 to this issue.
g. Windows-based VMware authd remote denial of service
A vulnerability in vmware-authd could cause a denial of service
condition on Windows-based hosts. The denial of service is limited
to a crash of authd.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2009-3707 to this issue.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 Windows 7.0.1 build 227600 or later
Workstation 7.0 Linux not affected
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 Windows 3.0.1 build 227600 or later
Player 3.x Linux not affected
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x Windows not being addressed at this time
Server 2.x Linux not affected
Fusion any Mac OS/X not affected
ESXi any any not affected
ESX any any not affected
h. Potential information leak via hosted networking stack
A vulnerability in the virtual networking stack of VMware hosted
products could allow host information disclosure.
A guest operating system could send memory from the host vmware-vmx
process to the virtual network adapter and potentially to the
host's physical Ethernet wire.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1138 to this issue.
VMware would like to thank Johann MacDonagh for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available.
VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected
Workstation 7.0 any 7.0.1 build 227600 or later
Workstation 6.5.x Windows 6.5.4 build 246459 or later
Workstation 6.5.x Linux not affected
Player 3.0 any 3.0.1 build 227600 or later
Player 2.5.x Windows 2.5.4 build 246459 or later
Player 2.5.x Linux not affected
Ace 2.6 Windows 2.6.1 build 227600 or later
Ace 2.5.x Windows 2.5.4 build 246459 or later
Server 2.x any not being fixed at this time
Fusion 3.0 Mac OS/X 3.0.1 build 232708 or later
Fusion 2.x Mac OS/X 2.0.7 build 246742 or later
ESXi any any not affected
ESX any any not affected
i.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2010-1139 to this issue.
VMware would like to thank Thomas Toth-Steiner for reporting this
issue to us.
The following table lists what action remediates the vulnerability
(column 4) if a solution is available. Solution
Please review the patch/release notes for your product and version
and verify the md5sum and/or the sha1sum of your downloaded file.
VMware Workstation Movie Decoder stand alone 6.5.4
--------------------------------------------------
http://download3.vmware.com/software/wkst/VMware-moviedecoder-6.5.4-246459.exe
md5sum: ea2ac5907ae4c5c323147fe155443ab8
sha1sum: 5ca8d1fd45f6a7a6f38019b259c3e836ee4e8f29
VMware Workstation 7.0.1
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-WIN
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Windows 32-bit and 64-bit with VMware Tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
Workstation for Windows 32-bit and 64-bit without VMware Tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-701-LX
Release notes:
http://downloads.vmware.com/support/ws7/doc/releasenotes_ws701.html
Workstation for Linux 32-bit with VMware Tools
md5sum: a896f7aaedde8799f21b52b89f5fc9ef
sha1sum: f6d0789afa7927ca154973a071603a0bd098e697
Workstation for Linux 32-bit without VMware Tools
md5sum: 59ecd27bdf3f59be3b4df8f04d1b3874
sha1sum: 22e1a475069fca5e8d2446bf14661fa6d894d34f
Workstation for Linux 64-bit with VMware Tools
md5sum: 808682eaa6b202fa29172821f7378768
sha1sum: a901c45a2a02678b0d1722e8f27152c3af12a7ac
Workstation for Linux 64-bit without VMware Tools
md5sum: 5116e27e7b13a76693402577bd9fda58
sha1sum: dbcd045a889b95ac14828b8106631b678354e30a
VMware Workstation 6.5.4
------------------------
For Windows
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-WIN
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
For Linux
http://downloads.vmware.com/download/download.do?downloadGroup=WKST-654-LX
Release Notes:
http://downloads.vmware.com/support/ws65/doc/releasenotes_ws654.html
Workstation for Linux 32-bit
Linux 32-bit .rpm
md5sum: 9efb43a604d50e541eb3be7081b8b198
sha1sum: 4240d664f85a11f47288d2279224b26bef92aa8b
Workstation for Linux 32-bit
Linux 32-bit .bundle
md5sum: 38760682ad3b2f6bfb4e40f424c95c2a
sha1sum: ec78099322b5fb2a737cd74a1978a5c07382dc8a
Workstation for Linux 64-bit
Linux 64-bit .rpm
md5sum: 24311492bc515e9bc98eff9b2e7d33a2
sha1sum: b4947ef09f740440e8a24fc2ba05c0a7c11b82f5
Workstation for Linux 64-bit
Linux 64-bit .bundle
md5sum: ed24296705ad48442549d9cb2b3c0d8d
sha1sum: 3c0f1efae0a64fa3a41be21b0bfc962f12e0e6d8
VMware Player 3.0.1
-------------------
http://downloads.vmware.com/tryvmware/?p=player&lp=default
Release notes:
http://downloads.vmware.com/support/player30/doc/releasenotes_player301.html
Player for Windows 32-bit and 64-bit
md5sum: 78c92c0242c9540f68a629d4ac49c516
sha1sum: 7fc255fcd1a6784458012314db1206ed922e92cf
Player for Linux 32-bit (.bundle)
md5sum: e7cd19d39c7bbd1aee582743d76a7863
sha1sum: cff76010f0429576288ea1e5a594cd47a2c64f4a
Player for Linux 64-bit (.bundle)
md5sum: 88b08537c6eea705883dc1755b97738c
sha1sum: 84f25370d24c03a18968a4f4c8e06cef3d21c2df
VMware VIX API for Windows 32-bit and 64-bit
md5sum: 2c46fc7e2516f331eb4dd23154d00a54
sha1sum: 85ceb1b718806c6870e3a918bcc772d1486ccdc9
VMware VIX API for 32-bit Linux
md5sum: 8b0994a26363246b5e954f97bd5a088d
sha1sum: af93da138a158ee6e05780a5c4042414735987b6
VMware VIX API for 64-bit Linux
md5sum: ef7b9890c52b1e333f2357760a7fff85
sha1sum: dfef8531356de78171e13c4c108ebaeb43eaa62d
VMware Player 2.5.4
-------------------
http://downloads.vmware.com/download/player/player_reg.html
Release notes:
http://downloads.vmware.com/support/player25/doc/releasenotes_player254.html
Player for Windows 32-bit and 64-bit (.exe)
md5sum: 531140a1eeed7d8b71f726b3d32a9174
sha1sum: 2500fa8af48452bd0e97040b80c569c3cb4f73e5
Player for Linux (.rpm)
md5sum: 1905f61af490f9760bef54450747e708
sha1sum: cf7444c0a6331439c5479a4158112a60eb0e6e8d
Player for Linux (.bundle)
md5sum: 74f539005687a4efce7971f7ef019af5
sha1sum: 4c4412c5807ecd00e66886e0e7c43ed61b62aab7
Player for Linux - 64-bit (.rpm)
md5sum: 013078d7f6adcdbcbaafbf5e0ae11a39
sha1sum: 7c434173a3fe446ebefce4803bfaa7ab67d1ff72
Player for Linux - 64-bit (.bundle)
md5sum: 175ce2f9656ff10a1327c0d48f80c65f
sha1sum: bf7acfdcb44bf345d58f79ad1bcb04816f262d22
VMware ACE 2.6.1
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-261-WIN
Release notes:
http://downloads.vmware.com/support/ace26/doc/releasenotes_ace261.html
VMware Workstation for 32-bit and 64-bit Windows with tools
md5sum: fc8502a748de3b8f94c5c9571c1f17d2
sha1sum: 3de01b355b17363a92d80200ff5e7267b3bde206
VMware Workstation for Windows 32-bit and 64-bit without tools
md5sum: 6a18ea3847cb727b03f7890f5643db79
sha1sum: 260b019db4619b0d1d775e5c38cc46b6db250984
ACE Management Server Virtual Appliance
md5sum: e26d258c511572064e99774fbac9184c
sha1sum: 9363656b70caa11a31a6229451202d9f8203c1f5
ACE Management Server for Windows
md5sum: e970828f2a5a62ac108879033a70f4b6
sha1sum: eca89372eacc78c3130781d0d183715055d64798
ACE Management Server for SUSE Enterprise Linux 9
md5sum: 59b3ad5964daef2844e72fd1765590fc
sha1sum: 91048de7665f5dc466f06e2ebc4c08f08026a97f
ACE Management Server for Red Hat Enterprise Linux 4
md5sum: 6623f6a8a645402a1c8c351ec99a1889
sha1sum: a6d74ba072c5a513fcf8993edebaaf7f8225c05d
VMware ACE 2.5.4
----------------
http://downloads.vmware.com/download/download.do?downloadGroup=ACE-254-WIN
Release notes:
http://downloads.vmware.com/support/ace25/doc/releasenotes_ace254.html
VMware ACE for Windows 32-bit and 64-bit
Windows 32-bit and 64-bit .exe
md5sum: 2dc393fcc4e78dcf2165098a4938699a
sha1sum: acfff457860c8c53c637c01f74f8aaa72d1c9569
ACE Management Server Virtual Appliance
AMS Virtual Appliance .zip
md5sum: 3935f23d4a074e7a3429a1c80cfd2155
sha1sum: 5b09439a9c840d39ae49fbd7a79732ecd58c52a3
ACE Management Server for Windows
Windows .exe
md5sum: 1173bd7da6ed330a262ed4e2eff6562c
sha1sum: d9bce88a350aa957f3387f870af763875d4d9110
ACE Management Server for SUSE Enterprise Linux 9
SLES 9 .rpm
md5sum: 0bec2cf8d6ae3bb6976c9d8cc2573208
sha1sum: f3c6d9ee3357535b1540cedd9e86d723e2ed2134
ACE Management Server for Red Hat Enterprise Linux 4
RHEL 4 .rpm
md5sum: 17caa522af79cf1f6b2ebad16a4ac8a5
sha1sum: cdd6e2a4e3d7ad89f95e60f1af024bea7eaba0fe
VMware Server 2.0.2
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server2/doc/releasenotes_vmserver202.html
VMware Server 2
Version 2.0.2 | 203138 - 10/26/09
507 MB EXE image VMware Server 2 for Windows Operating Systems. A
master installer file containing all Windows components of VMware
Server.
Version 2.0.2 | 203138 - 10/26/09
37 MB TAR image
md5sum: 95ddea5a0579a35887bd15b083ffea20
sha1sum: 14cf12063a7480f240ccd96178ad4258cb26a747
VMware Server 2 for Linux Operating Systems 64-bit version.
Version 2.0.2 | 203138 - 10/26/09
452 MB RPM image
md5sum: 35c8b176601133749e4055e0034f8be6
sha1sum: e8dc842d89899df5cd3e1136af76f19ca5ccbece
The core application needed to run VMware Server 2, 64-bit version.
The same patch, ESXe350-200912402-T-BG, is also contained in
ESXe350-201002401-O-SG from February 2010 ESXi 3.5 security update.
In latest non-security ESXi 3.5 update, ESXe350-201003402-T-BG is also
included in ESXe350-201003401-O-BG from March 2010.
ESXe350-201002401-O-SG (latest security update)
http://download3.vmware.com/software/vi/ESXe350-201002401-O-SG.zip
md5sum: 0c8d4d1c0e3c2aed9f785cf081225d83
http://kb.vmware.com/kb/1015047 (Vi Client)
http://kb.vmware.com/kb/1016665 (VM Tools)
http://kb.vmware.com/kb/1017685 (Firmware)
The three ESXi patches for Firmware "I", VMware Tools "T," and the
VI Client "C" are contained in a single offline "O" download file.
ESX
---
ESX 4.0 bulletin ESX400-201002401-BG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-192-20100228-732240/ESX400-201002001.zip
md5sum: de62cbccaffa4b2b6831617f18c1ccb4
sha1sum: 4083f191fa4acd6600c9a87e4852f9f5700e91ab
http://kb.vmware.com/kb/1018403
Note: ESX400-201002001 contains the bundle with the security fix,
ESX400-201002401-BG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX400-201002001 -b ESX400-201002401-BG
ESX 4.0 bulletin ESX400-200911223-UG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-166-20091202-254879/ESX-4.0.0-update01a.zip
md5sum: 99c1fcafbf0ca105ce73840d686e9914
sha1sum: aa8a23416271bc28b6b8f6bdbe00045e36314ebb
http://kb.vmware.com/kb/1014842
Note: ESX-4.0.0-update01a contains the bundle with the security fix,
ESX400-200911223-UG
To install an individual bulletin use esxupdate with the -b option.
esxupdate --bundle ESX-4.0.0-update01a -b ESX400-200911223-UG
ESX 3.5 patch ESX350-200912401-BG
http://download3.vmware.com/software/vi/ESX350-200912401-BG.zip
md5sum: f1d3589745b4ae933554785aef22bacc
sha1sum: d1e5a9209b165d43d75f076e556fc028bec4cc47
http://kb.vmware.com/kb/1016657
ESX 3.0.3 patch ESX303-201002203-UG
http://download3.vmware.com/software/vi/ESX303-201002203-UG.zip
md5sum: 49ee56b687707cbe6999836c315f081a
http://kb.vmware.com/kb/1018030
ESX 2.5.5 Upgrade Patch 15
http://download3.vmware.com/software/esx/esx-2.5.5-191611-upgrade.tar.gz
md5sum: c346fe510b6e51145570e03083f77357
sha1sum: ef6b19247825fb3fe2c55f8fda3cdd05ac7bb1f4
http://www.vmware.com/support/esx25/doc/esx-255-200910-patch.html
5. References
http://www.acrossecurity.com/advisories.htm
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1140
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141
6. Change log
2010-04-09 VMSA-2010-0007
Initial security advisory after release of Workstation 6.5.4 and Fusion
2.0.7 on 2010-04-08.
- ------------------------------------------------------------------------
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html
Copyright 2010 VMware Inc. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFLvvM8S2KysvBH1xkRAgu/AJ9RrzlOq/5Ug0t8R4qoi/UwDVJDpACbBGgT
d58bjKG6Ic7m/TsoJP4M2tw=
=Q1zv
-----END PGP SIGNATURE-----
.
For more information see vulnerabilities #3 through #7 in:
SA39206
SOLUTION:
Restrict local access to trusted users only. Do not open untrusted
images or video files.
Background
==========
VMware Player, Server, and Workstation allow emulation of a complete PC
on a PC without the usual performance overhead of most emulators.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-emulation/vmware-player
<= 2.5.5.328052 Vulnerable!
2 app-emulation/vmware-workstation
<= 6.5.5.328052 Vulnerable!
3 app-emulation/vmware-server
<= 1.0.9.156507 Vulnerable!
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers. Please review the CVE identifiers referenced below for
details.
A remote attacker could entice a user to open a specially crafted file,
possibly resulting in the remote execution of arbitrary code, or a
Denial of Service. Remote attackers also may be able to spoof DNS
traffic, read arbitrary files, or inject arbitrary web script to the
VMware Server Console.
Furthermore, guest OS users may be able to execute arbitrary code on
the host OS, gain escalated privileges on the guest OS, or cause a
Denial of Service (crash the host OS).
Workaround
==========
There is no known workaround at this time. We recommend that users
unmerge VMware Server:
# emerge --unmerge "app-emulation/vmware-server"
References
==========
[ 1 ] CVE-2007-5269
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269
[ 2 ] CVE-2007-5503
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5503
[ 3 ] CVE-2007-5671
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5671
[ 4 ] CVE-2008-0967
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0967
[ 5 ] CVE-2008-1340
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1340
[ 6 ] CVE-2008-1361
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1361
[ 7 ] CVE-2008-1362
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1362
[ 8 ] CVE-2008-1363
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1363
[ 9 ] CVE-2008-1364
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1364
[ 10 ] CVE-2008-1392
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1392
[ 11 ] CVE-2008-1447
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1447
[ 12 ] CVE-2008-1806
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1806
[ 13 ] CVE-2008-1807
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1807
[ 14 ] CVE-2008-1808
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1808
[ 15 ] CVE-2008-2098
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2098
[ 16 ] CVE-2008-2100
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2100
[ 17 ] CVE-2008-2101
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2101
[ 18 ] CVE-2008-4915
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4915
[ 19 ] CVE-2008-4916
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4916
[ 20 ] CVE-2008-4917
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4917
[ 21 ] CVE-2009-0040
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0040
[ 22 ] CVE-2009-0909
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0909
[ 23 ] CVE-2009-0910
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0910
[ 24 ] CVE-2009-1244
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1244
[ 25 ] CVE-2009-2267
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2267
[ 26 ] CVE-2009-3707
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3707
[ 27 ] CVE-2009-3732
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3732
[ 28 ] CVE-2009-3733
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3733
[ 29 ] CVE-2009-4811
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4811
[ 30 ] CVE-2010-1137
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1137
[ 31 ] CVE-2010-1138
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1138
[ 32 ] CVE-2010-1139
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1139
[ 33 ] CVE-2010-1140
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1140
[ 34 ] CVE-2010-1141
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1141
[ 35 ] CVE-2010-1142
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1142
[ 36 ] CVE-2010-1143
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1143
[ 37 ] CVE-2011-3868
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3868
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-25.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Secunia CSI
+ Microsoft SCCM
-----------------------
= Extensive Patch Management
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
----------------------------------------------------------------------
TITLE:
VMware Products Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA39206
VERIFY ADVISORY:
http://secunia.com/advisories/39206/
DESCRIPTION:
Some vulnerabilities have been reported in multiple VMware products,
which can be exploited by malicious, local users to disclose
sensitive information or gain escalated privileges, and by malicious
people to disclose sensitive information, cause a DoS (Denial of
Service), or potentially compromise a user's system.
NOTE: This vulnerability cannot be exploited without administrative
privileges on recent Windows versions (e.g. Windows XP and Windows
Vista).
3) An error in libpng can be exploited to disclose uninitialised
memory via a specially crafted image.
For more information:
SA35346
4) A boundary error and two integer truncation errors in the VMnc
codec can be exploited to potentially execute arbitrary code.
For more information:
SA36712
5) An error in the VMware Authorization Service ("vmware-authd") can
be exploited to cause a crash.
For more information:
SA39201
SOLUTION:
Update to a fixed version.
PROVIDED AND/OR DISCOVERED BY:
4) Alin Rad Pop, Secunia Research
The vendor also credits:
1) Jure Skofic and Mitja Kolsek of ACROS Security
2) Thierry Zoller
4) iDefense and Sebastien Renaud of Vupen
6) Johann MacDonagh
7) Thomas Toth-Steiner
ORIGINAL ADVISORY:
VMware (VMSA-2010-0007):
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
Secunia Research:
http://secunia.com/secunia_research/2009-36/
http://secunia.com/secunia_research/2009-37/
OTHER REFERENCES:
SA35346:
http://secunia.com/advisories/35346/
SA36712:
http://secunia.com/advisories/36712/
SA36988:
http://secunia.com/advisories/36988/
SA39198:
http://secunia.com/advisories/39198/
SA39201:
http://secunia.com/advisories/39201/
SA39203:
http://secunia.com/advisories/39203/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0063 | CVE-2010-0594 | Cisco Router and Security Device Manager vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Cisco Router and Security Device Manager (SDM) allows remote attackers to inject arbitrary web script or HTML via unknown vectors, aka Bug ID CSCtb38467. Cisco Router and Security Device Manager (SDM) is a web-based device management tool for Cisco routers.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
This issue is being tracked by Cisco Bugid CSCtb38467. The bug ID is CSCtb38467
VAR-201004-0739 | No CVE | RETIRED: Oracle April 2010 Critical Patch Update Multiple Vulnerabilities |
CVSS V2: - CVSS V3: - Severity: - |
Oracle has released advance notification regarding the April 2010 critical patch update to be released on April 13, 2010. The update addresses 47 vulnerabilities affecting the following software:
Oracle Database
Oracle Fusion Middleware
Oracle Collaboration Suite
Oracle E-Business Suite
Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne
Oracle Industry Suite
Oracle Solaris Products
The following individual records exist to better document these issues:
39453 Oracle Sun Java System Directory Server CVE-2010-0897 Multiple Remote Vulnerabilities
39459 Oracle Solaris CVE-2010-0890 Local Vulnerability
39462 Oracle Sun Management Center CVE-2010-0891 Remote Vulnerability
39456 Oracle OpenSolaris CVE-2010-0889 Local Information Disclosure Vulnerability
39461 Oracle Sun Java System Communications Express CVE-2010-0885 Remote Address Book Vulnerability
39464 Oracle Cluster CVE-2010-0884 Unspecified Local Vulnerability
39460 Oracle Cluster CVE-2010-0883 Unspecified Local Vulnerability
39457 Oracle Java System Access Manager CVE-2010-0894 Remote Vulnerability
39458 Oracle Sun Convergence CVE-2010-0896 Remote Address Book/Mail Filter Vulnerability
39448 Oracle Industry Products Suite CVE-2010-0864 Remote Retail Place In-Season Vulnerability
39455 Oracle Solaris CVE-2010-0895 Unspecified Local Vulnerability
39454 Oracle Industry Product Suite CVE-2010-0863 Oracle Retail Plan In-Season Vulnerability
39451 Oracle Industry Applications CVE-2010-0875 Remote Thesaurus Management System Vulnerability
39452 Oracle E-Business Suite CVE-2010-0859 Remote Oracle Application Object Library Vulnerability
39450 Oracle Communications Industry Suite CVE-2010-0874 Remote Vulnerability
39444 Oracle Industry Product Suite CVE-2010-0862 Remote Vulnerability
39445 Oracle Life Sciences Industry Suite CVE-2010-0876 Remote Vulnerability
39446 Oracle Convergence CVE-2010-0893 Unspecified Remote Vulnerability
39447 Oracle Collaboration Suite CVE-2010-0881 Remote User Interface Components Vulnerability
39443 Oracle Fusion Middleware CVE-2010-0872 Remote Oracle Internet Directory Vulnerability
39437 Oracle Fusion Middleware CVE-2010-0855 Remote Portal Vulnerability
39442 Oracle Fusion Middleware CVE-2010-0856 Remote Portal Vulnerability
39441 PeopleSoft Enterprise and JD Edwards EnterpriseOne CVE-2010-0879 Remote PeopleTools Vulnerability
39440 Oracle Solaris CVE-2010-0882 Local Trusted Extensions Vulnerability
39439 Oracle Database CVE-2010-0860 Remote Core RDBMS Vulnerability
39432 Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne CVE-2010-0878 PeopleTools Vulnerability
39421 Oracle Database CVE-2010-0852 Remote XML DB Vulnerability
39438 Oracle Transportation Manager CVE-2010-0869 Oracle Transportation Management Remote Vulnerability
39429 Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne CVE-2010-0877 PeopleTools Vulnerability
39434 Oracle Database CVE-2010-0851 Remote XML DB Vulnerability
39428 Oracle Database CVE-2010-0854 Remote Audit Vulnerability
39424 Oracle Database CVE-2010-0866 Remote JavaVM Vulnerability
39436 Oracle E-Business Suite CVE-2010-0858 Remote E-Business Intelligence Vulnerability
39422 Oracle Database CVE-2010-0870 Remote Change Data Capture Vulnerability
39435 Oracle E-Business Suite CVE-2010-0871 Oracle Application Object Library Remote Vulnerability
39427 Oracle Database CVE-2010-0867 Remote JavaVM Vulnerability
39433 Oracle Fusion Middleware CVE-2010-0086 Remote Portal Vulnerability
39425 Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne CVE-2010-0880 PeopleTools Vulnerability
39430 Oracle E-Business Suite CVE-2010-0865 Oracle Agile Engineering Data Management Remote Vulnerability
39423 Oracle E-Business Suite CVE-2010-0868 Oracle iStore Remote Vulnerability
39431 Oracle E-Business Suite CVE-2010-0857 Remote Oracle Workflow Cartridge Vulnerability
39426 Oracle E-Business Suite CVE-2010-0861 Oracle HRMS (Self Service) Remote Vulnerability
37926 Oracle WebLogic Server Node Manager 'beasvc.exe' Remote Command Execution Vulnerability
39418 Oracle Fusion Middleware CVE-2010-0853 Oracle Internet Directory Remote Vulnerability
39420 Oracle Sun Ray Server Software CVE-2010-0888 Remote Device Services Vulnerability
35891 Mozilla Firefox and Seamonkey Regular Expression Parsing Heap Buffer Overflow Vulnerability
34961 Cyrus SASL 'sasl_encode64()' Remote Buffer Overflow Vulnerability
38016 Sun Solaris 'CODE_GET_VERSION IOCTL' Local Denial Of Service Vulnerability
VAR-201004-0133 | CVE-2010-0193 | Adobe Reader and Acrobat Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2010-0192 and CVE-2010-0196. This vulnerability CVE-2010-0192 and CVE-2010-0196 Is a different vulnerability.Service disruption by a third party (DoS) Could be put into a state or execute arbitrary code. Adobe Acrobat and Reader are prone to a denial-of-service vulnerability.
Attackers can exploit this issue to crash the application, resulting in a denial-of-service condition. Due to the nature of this issue, arbitrary code execution may also be possible but this has not been confirmed.
The following products are affected:
Adobe Reader 9.3.1 and prior for Windows, Macintosh, and UNIX
Adobe Acrobat 9.3.1 and prior for Windows and Macintosh
Adobe Reader 8.2.1 and prior for Windows and Macintosh
Acrobat 8.2.1 and prior for Windows and Macintosh
Note: This vulnerability was previously documented in BID 39329 (Adobe Acrobat and Reader April 2010 Multiple Remote Vulnerabilities) but has been given its own record to better document the issue.
Attackers can exploit these issues to steal cookie-based authentication credentials, cause a denial-of-service, or execute arbitrary code in the context of the user running an affected application.
I. These
vulnerabilities affect Reader and Acrobat 9.3.1 and earlier 9.x
versions, and 8.2.1 and earlier versions.
An attacker could exploit these vulnerabilities by convincing a
user to open a specially crafted PDF file. The Adobe Reader browser
plug-in is available for multiple web browsers and operating
systems, which can automatically open PDF documents hosted on a
website.
II.
III. For a fresh installation, first install
Adobe Reader 9.3.0 or 8.2.0 and then use the automatic update
feature or install the appropriate update referenced in APSB10-09. Acrobat JavaScript can be disabled using the
Preferences menu (Edit -> Preferences -> JavaScript; uncheck Enable
Acrobat JavaScript).
Adobe provides a framework to blacklist specific JavaScipt APIs. If
JavaScript must be enabled, this feature may be useful when
specific APIs are known to be vulnerable or used in attacks.
Prevent Internet Explorer from automatically opening PDF documents
The installer for Adobe Reader and Acrobat configures Internet
Explorer to automatically open PDF files without any user
interaction. This behavior can be reverted to a safer option that
prompts the user by importing the following as a .REG file:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00
Disable the display of PDF documents in the web browser
Preventing PDF documents from opening inside a web browser will
partially mitigate this vulnerability. If this workaround is
applied, it may also mitigate future vulnerabilities.
To prevent PDF documents from automatically being opened in a web
browser, do the following:
1.
2. Open the Edit menu.
3. Choose the Preferences option.
4. Choose the Internet section.
5. Uncheck the "Display PDF in browser" checkbox.
Do not access PDF documents from untrusted sources
Do not open unfamiliar or unexpected PDF documents, particularly
those hosted on websites or delivered as email attachments. Please
see Cyber Security Tip ST04-010.
IV. Please send
email to <cert@cert.org> with "TA10-103C Feedback VU#352598" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
April 13, 2010: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBS8TuRj6pPKYJORa3AQJfzggAj8p3s/TrJT16ceFtRzLR31QBgRq6GxYr
h8WnsGlj2WR71XjH219XaWx9Mj3KBWVxbAsNPmK0tEir7KA+n4DwZCewTDYRqfYs
8N7G9MOI68Z87+7zBiZAo0j5/lQuxLWyTF9PqWbX8gCWLqJWW46cEZCqg7OGRbYt
w8coxdMXU6tM3WGoWAIKwLRtpQUdubcITPTrE7RATyLJ1422B9dkTSeSCuHHZs5d
eXSPYzTQ1EOwHpuA5/a/or2SjeRPLQcpxb/8WKelSqwW3hpK4zviEnPt4cYyeNqW
BQY06OQMTKch/nmniuEDuiwe69m0gTw7Tw2Dm6xrg6BLBy3A6GAwkQ==
=CQ6i
-----END PGP SIGNATURE-----
. For further
information please consult the CVE entries and the Adobe Security
Bulletins referenced below.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"
References
==========
[ 1 ] APSA10-01
http://www.adobe.com/support/security/advisories/apsa10-01.html
[ 2 ] APSB10-02
http://www.adobe.com/support/security/bulletins/apsb10-02.html
[ 3 ] APSB10-07
http://www.adobe.com/support/security/bulletins/apsb10-07.html
[ 4 ] APSB10-09
http://www.adobe.com/support/security/bulletins/apsb10-09.html
[ 5 ] APSB10-14
http://www.adobe.com/support/security/bulletins/apsb10-14.html
[ 6 ] APSB10-16
http://www.adobe.com/support/security/bulletins/apsb10-16.html
[ 7 ] CVE-2009-3953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953
[ 8 ] CVE-2009-4324
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324
[ 9 ] CVE-2010-0186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186
[ 10 ] CVE-2010-0188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188
[ 11 ] CVE-2010-0190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190
[ 12 ] CVE-2010-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191
[ 13 ] CVE-2010-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192
[ 14 ] CVE-2010-0193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193
[ 15 ] CVE-2010-0194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194
[ 16 ] CVE-2010-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195
[ 17 ] CVE-2010-0196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196
[ 18 ] CVE-2010-0197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197
[ 19 ] CVE-2010-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198
[ 20 ] CVE-2010-0199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199
[ 21 ] CVE-2010-0201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201
[ 22 ] CVE-2010-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202
[ 23 ] CVE-2010-0203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203
[ 24 ] CVE-2010-0204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204
[ 25 ] CVE-2010-1241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241
[ 26 ] CVE-2010-1285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285
[ 27 ] CVE-2010-1295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295
[ 28 ] CVE-2010-1297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297
[ 29 ] CVE-2010-2168
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168
[ 30 ] CVE-2010-2201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201
[ 31 ] CVE-2010-2202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202
[ 32 ] CVE-2010-2203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203
[ 33 ] CVE-2010-2204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204
[ 34 ] CVE-2010-2205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205
[ 35 ] CVE-2010-2206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206
[ 36 ] CVE-2010-2207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207
[ 37 ] CVE-2010-2208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208
[ 38 ] CVE-2010-2209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209
[ 39 ] CVE-2010-2210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210
[ 40 ] CVE-2010-2211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211
[ 41 ] CVE-2010-2212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-05.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
VAR-201004-0132 | CVE-2010-0192 | Adobe Reader and Acrobat Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2010-0193 and CVE-2010-0196. This vulnerability CVE-2010-0193 and CVE-2010-0196 Is a different vulnerability.Service disruption by a third party (DoS) Could be put into a state or execute arbitrary code. Adobe Acrobat and Reader are prone to a denial-of-service vulnerability.
Attackers can exploit this issue to crash the application, resulting in a denial-of-service condition. Due to the nature of this issue arbitrary code execution may also be possible but this has not been confirmed.
The following products are affected:
Adobe Reader 9.3.1 and prior for Windows, Macintosh, and UNIX
Adobe Acrobat 9.3.1 and prior for Windows and Macintosh
Adobe Reader 8.2.1 and prior for Windows and Macintosh
Acrobat 8.2.1 and prior for Windows and Macintosh
Note: This vulnerability was previously documented in BID 39329 (Adobe Acrobat and Reader April 2010 Multiple Remote Vulnerabilities) but has been given its own record to better document the issue.
Attackers can exploit these issues to steal cookie-based authentication credentials, cause a denial-of-service, or execute arbitrary code in the context of the user running an affected application.
I. These
vulnerabilities affect Reader and Acrobat 9.3.1 and earlier 9.x
versions, and 8.2.1 and earlier versions.
An attacker could exploit these vulnerabilities by convincing a
user to open a specially crafted PDF file. The Adobe Reader browser
plug-in is available for multiple web browsers and operating
systems, which can automatically open PDF documents hosted on a
website.
II.
III. For a fresh installation, first install
Adobe Reader 9.3.0 or 8.2.0 and then use the automatic update
feature or install the appropriate update referenced in APSB10-09. Acrobat JavaScript can be disabled using the
Preferences menu (Edit -> Preferences -> JavaScript; uncheck Enable
Acrobat JavaScript).
Adobe provides a framework to blacklist specific JavaScipt APIs. If
JavaScript must be enabled, this feature may be useful when
specific APIs are known to be vulnerable or used in attacks.
Prevent Internet Explorer from automatically opening PDF documents
The installer for Adobe Reader and Acrobat configures Internet
Explorer to automatically open PDF files without any user
interaction. This behavior can be reverted to a safer option that
prompts the user by importing the following as a .REG file:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00
Disable the display of PDF documents in the web browser
Preventing PDF documents from opening inside a web browser will
partially mitigate this vulnerability. If this workaround is
applied, it may also mitigate future vulnerabilities.
To prevent PDF documents from automatically being opened in a web
browser, do the following:
1.
2. Open the Edit menu.
3. Choose the Preferences option.
4. Choose the Internet section.
5. Uncheck the "Display PDF in browser" checkbox.
Do not access PDF documents from untrusted sources
Do not open unfamiliar or unexpected PDF documents, particularly
those hosted on websites or delivered as email attachments. Please
see Cyber Security Tip ST04-010.
IV. Please send
email to <cert@cert.org> with "TA10-103C Feedback VU#352598" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
April 13, 2010: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBS8TuRj6pPKYJORa3AQJfzggAj8p3s/TrJT16ceFtRzLR31QBgRq6GxYr
h8WnsGlj2WR71XjH219XaWx9Mj3KBWVxbAsNPmK0tEir7KA+n4DwZCewTDYRqfYs
8N7G9MOI68Z87+7zBiZAo0j5/lQuxLWyTF9PqWbX8gCWLqJWW46cEZCqg7OGRbYt
w8coxdMXU6tM3WGoWAIKwLRtpQUdubcITPTrE7RATyLJ1422B9dkTSeSCuHHZs5d
eXSPYzTQ1EOwHpuA5/a/or2SjeRPLQcpxb/8WKelSqwW3hpK4zviEnPt4cYyeNqW
BQY06OQMTKch/nmniuEDuiwe69m0gTw7Tw2Dm6xrg6BLBy3A6GAwkQ==
=CQ6i
-----END PGP SIGNATURE-----
. For further
information please consult the CVE entries and the Adobe Security
Bulletins referenced below.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"
References
==========
[ 1 ] APSA10-01
http://www.adobe.com/support/security/advisories/apsa10-01.html
[ 2 ] APSB10-02
http://www.adobe.com/support/security/bulletins/apsb10-02.html
[ 3 ] APSB10-07
http://www.adobe.com/support/security/bulletins/apsb10-07.html
[ 4 ] APSB10-09
http://www.adobe.com/support/security/bulletins/apsb10-09.html
[ 5 ] APSB10-14
http://www.adobe.com/support/security/bulletins/apsb10-14.html
[ 6 ] APSB10-16
http://www.adobe.com/support/security/bulletins/apsb10-16.html
[ 7 ] CVE-2009-3953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953
[ 8 ] CVE-2009-4324
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324
[ 9 ] CVE-2010-0186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186
[ 10 ] CVE-2010-0188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188
[ 11 ] CVE-2010-0190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190
[ 12 ] CVE-2010-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191
[ 13 ] CVE-2010-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192
[ 14 ] CVE-2010-0193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193
[ 15 ] CVE-2010-0194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194
[ 16 ] CVE-2010-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195
[ 17 ] CVE-2010-0196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196
[ 18 ] CVE-2010-0197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197
[ 19 ] CVE-2010-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198
[ 20 ] CVE-2010-0199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199
[ 21 ] CVE-2010-0201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201
[ 22 ] CVE-2010-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202
[ 23 ] CVE-2010-0203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203
[ 24 ] CVE-2010-0204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204
[ 25 ] CVE-2010-1241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241
[ 26 ] CVE-2010-1285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285
[ 27 ] CVE-2010-1295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295
[ 28 ] CVE-2010-1297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297
[ 29 ] CVE-2010-2168
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168
[ 30 ] CVE-2010-2201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201
[ 31 ] CVE-2010-2202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202
[ 32 ] CVE-2010-2203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203
[ 33 ] CVE-2010-2204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204
[ 34 ] CVE-2010-2205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205
[ 35 ] CVE-2010-2206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206
[ 36 ] CVE-2010-2207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207
[ 37 ] CVE-2010-2208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208
[ 38 ] CVE-2010-2209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209
[ 39 ] CVE-2010-2210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210
[ 40 ] CVE-2010-2211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211
[ 41 ] CVE-2010-2212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-05.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
VAR-201004-0130 | CVE-2010-0190 | Adobe Reader and Acrobat Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Adobe released an advisory addressing multiple issues in Reader and Acrobat.
Attackers can exploit these issues to steal cookie-based authentication credentials, cause a denial-of-service, or execute arbitrary code in the context of the user running an affected application.
NOTE: This BID is being retired; the following individual records have been created to document these vulnerabilities:
39515 Adobe Acrobat and Reader CVE-2010-0190 Cross Site Scripting Vulnerability
39517 Adobe Acrobat and Reader Prefix Protocol Handler Remote Code Execution Vulnerability
39523 Adobe Acrobat and Reader CVE-2010-0192 Denial of Service Vulnerability
39524 Adobe Acrobat and Reader CVE-2010-0193 Denial of Service Vulnerability
39521 Adobe Acrobat and Reader CVE-2010-0196 Denial of Service Vulnerability
39518 Adobe Acrobat and Reader CVE-2010-0197 Remote Code Execution Vulnerability
39505 Adobe Acrobat and Reader PNG Data Remote Buffer Overflow Vulnerability
39511 Adobe Acrobat and Reader JPEG Data Remote Buffer Overflow Vulnerability
39520 Adobe Acrobat and Reader CVE-2010-0201 Remote Code Execution Vulnerability
39514 Adobe Acrobat and Reader GIF Data Remote Buffer Overflow Vulnerability
39507 Adobe Acrobat and Reader BMP Data Remote Buffer Overflow Vulnerability
39522 Adobe Acrobat and Reader CVE-2010-0204 Remote Code Execution Vulnerability
39470 Adobe Acrobat and Reader CVE-2010-1241 'CoolType.dll' Remote Code Execution Vulnerability
39469 Adobe Acrobat and Reader CVE-2010-0194 X3D Component Remote Code Execution Vulnerability
39417 Adobe Acrobat and Reader CVE-2010-0195 Embedded Font Handling Remote Code Execution Vulnerability.
I. These
vulnerabilities affect Reader and Acrobat 9.3.1 and earlier 9.x
versions, and 8.2.1 and earlier versions.
An attacker could exploit these vulnerabilities by convincing a
user to open a specially crafted PDF file. The Adobe Reader browser
plug-in is available for multiple web browsers and operating
systems, which can automatically open PDF documents hosted on a
website.
II.
III. For a fresh installation, first install
Adobe Reader 9.3.0 or 8.2.0 and then use the automatic update
feature or install the appropriate update referenced in APSB10-09. Acrobat JavaScript can be disabled using the
Preferences menu (Edit -> Preferences -> JavaScript; uncheck Enable
Acrobat JavaScript).
Adobe provides a framework to blacklist specific JavaScipt APIs. If
JavaScript must be enabled, this feature may be useful when
specific APIs are known to be vulnerable or used in attacks.
Prevent Internet Explorer from automatically opening PDF documents
The installer for Adobe Reader and Acrobat configures Internet
Explorer to automatically open PDF files without any user
interaction. This behavior can be reverted to a safer option that
prompts the user by importing the following as a .REG file:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00
Disable the display of PDF documents in the web browser
Preventing PDF documents from opening inside a web browser will
partially mitigate this vulnerability. If this workaround is
applied, it may also mitigate future vulnerabilities.
To prevent PDF documents from automatically being opened in a web
browser, do the following:
1.
2. Open the Edit menu.
3. Choose the Preferences option.
4. Choose the Internet section.
5. Uncheck the "Display PDF in browser" checkbox.
Do not access PDF documents from untrusted sources
Do not open unfamiliar or unexpected PDF documents, particularly
those hosted on websites or delivered as email attachments. Please
see Cyber Security Tip ST04-010.
IV. Please send
email to <cert@cert.org> with "TA10-103C Feedback VU#352598" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
April 13, 2010: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBS8TuRj6pPKYJORa3AQJfzggAj8p3s/TrJT16ceFtRzLR31QBgRq6GxYr
h8WnsGlj2WR71XjH219XaWx9Mj3KBWVxbAsNPmK0tEir7KA+n4DwZCewTDYRqfYs
8N7G9MOI68Z87+7zBiZAo0j5/lQuxLWyTF9PqWbX8gCWLqJWW46cEZCqg7OGRbYt
w8coxdMXU6tM3WGoWAIKwLRtpQUdubcITPTrE7RATyLJ1422B9dkTSeSCuHHZs5d
eXSPYzTQ1EOwHpuA5/a/or2SjeRPLQcpxb/8WKelSqwW3hpK4zviEnPt4cYyeNqW
BQY06OQMTKch/nmniuEDuiwe69m0gTw7Tw2Dm6xrg6BLBy3A6GAwkQ==
=CQ6i
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Adobe Reader: Multiple vulnerabilities
Date: September 07, 2010
Bugs: #297385, #306429, #313343, #322857
ID: 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities in Adobe Reader might result in the execution
of arbitrary code or other attacks. For further
information please consult the CVE entries and the Adobe Security
Bulletins referenced below.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"
References
==========
[ 1 ] APSA10-01
http://www.adobe.com/support/security/advisories/apsa10-01.html
[ 2 ] APSB10-02
http://www.adobe.com/support/security/bulletins/apsb10-02.html
[ 3 ] APSB10-07
http://www.adobe.com/support/security/bulletins/apsb10-07.html
[ 4 ] APSB10-09
http://www.adobe.com/support/security/bulletins/apsb10-09.html
[ 5 ] APSB10-14
http://www.adobe.com/support/security/bulletins/apsb10-14.html
[ 6 ] APSB10-16
http://www.adobe.com/support/security/bulletins/apsb10-16.html
[ 7 ] CVE-2009-3953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953
[ 8 ] CVE-2009-4324
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324
[ 9 ] CVE-2010-0186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186
[ 10 ] CVE-2010-0188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188
[ 11 ] CVE-2010-0190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190
[ 12 ] CVE-2010-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191
[ 13 ] CVE-2010-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192
[ 14 ] CVE-2010-0193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193
[ 15 ] CVE-2010-0194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194
[ 16 ] CVE-2010-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195
[ 17 ] CVE-2010-0196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196
[ 18 ] CVE-2010-0197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197
[ 19 ] CVE-2010-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198
[ 20 ] CVE-2010-0199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199
[ 21 ] CVE-2010-0201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201
[ 22 ] CVE-2010-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202
[ 23 ] CVE-2010-0203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203
[ 24 ] CVE-2010-0204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204
[ 25 ] CVE-2010-1241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241
[ 26 ] CVE-2010-1285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285
[ 27 ] CVE-2010-1295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295
[ 28 ] CVE-2010-1297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297
[ 29 ] CVE-2010-2168
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168
[ 30 ] CVE-2010-2201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201
[ 31 ] CVE-2010-2202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202
[ 32 ] CVE-2010-2203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203
[ 33 ] CVE-2010-2204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204
[ 34 ] CVE-2010-2205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205
[ 35 ] CVE-2010-2206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206
[ 36 ] CVE-2010-2207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207
[ 37 ] CVE-2010-2208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208
[ 38 ] CVE-2010-2209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209
[ 39 ] CVE-2010-2210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210
[ 40 ] CVE-2010-2211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211
[ 41 ] CVE-2010-2212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-05.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5