Alerts This Week
Warning Icon 1 626
Alerts This Week
Warning Icon 1 626

Gentoo GLSA-201209-25 Critical: Multiple VMware Vulnerabilities and Risks

gentoo
Calendar Grey September 29, 2012
Dist Gentoo Esm H88
Several security flaws have been identified in VMware applications on Gentoo, leading to potential dangers such as unauthorized remote access and elevation of privileges.
Multiple vulnerabilities have been found in VMware Player, Server, and Workstation, allowing remote and local attackers to conduct several attacks, including privilege escalation, ...

Summary

Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details.

Topics%20covered

Topics Covered

security advisory Gentoo high severity privilege escalation remote execution Denial of Service VMware

Resolution

Gentoo discontinued support for VMware Player. We recommend that usersunmerge VMware Player: # emerge --unmerge "app-emulation/vmware-player"
NOTE: Users could upgrade to ">=app-emulation/vmware-player-3.1.5", however these packages are not currently stable.
Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Workstation:
# emerge --unmerge "app-emulation/vmware-workstation"
NOTE: Users could upgrade to ">=app-emulation/vmware-workstation-7.1.5", however these packages are not currently stable.
Gentoo discontinued support for VMware Server. We recommend that usersunmerge VMware Server:
# emerge --unmerge "app-emulation/vmware-server"

References

[ 1 ] CVE-2007-5269 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269 [ 2 ] CVE-2007-5503 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5503 [ 3 ] CVE-2007-5671 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5671 [ 4 ] CVE-2008-0967 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0967 [ 5 ] CVE-2008-1340 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1340 [ 6 ] CVE-2008-1361 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1361 [ 7 ] CVE-2008-1362 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1362 [ 8 ] CVE-2008-1363 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1363 [ 9 ] CVE-2008-1364 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1364 [ 10 ] CVE-2008-1392 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1392 [ 11 ] CVE-2008-1447 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1447 [ 12 ] CVE-2008-1806 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1806 [ 13 ] CVE-2008-1807 http://nvd.nist.gov/nvd.cfm?cvena...

Read the Full Advisory

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201209-25
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: VMware Player, Server, Workstation: Multiple vulnerabilities
Date: September 29, 2012
Bugs: #213548, #224637, #236167, #245941, #265139, #282213,
ID: 201209-25

Topics%20covered

Topics Covered

security advisory Gentoo high severity privilege escalation remote execution Denial of Service VMware

Synopsis

Multiple vulnerabilities have been found in VMware Player, Server, and Workstation, allowing remote and local attackers to conduct several attacks, including privilege escalation, remote execution of arbitrary code, and a Denial of Service.

Background

VMware Player, Server, and Workstation allow emulation of a complete PC on a PC without the usual performance overhead of most emulators.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-emulation/vmware-player <= 2.5.5.328052 Vulnerable! 2 app-emulation/vmware-workstation <= 6.5.5.328052 Vulnerable! 3 app-emulation/vmware-server <= 1.0.9.156507 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. ------------------------------------------------------------------- 3 affected packages

Impact

===== Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information. A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.
Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).

Workaround

There is no known workaround at this time.

Related News

Your message here