Discover Government News

==========================================================================
Ubuntu Security Notice USN-6365-1
September 13, 2023

open-vm-tools vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Open VM Tools could allow unintended access to network services.

Software Description:
- open-vm-tools: Open VMware Tools for virtual machines hosted on VMware

Details:

It was discovered that Open VM Tools incorrectly handled SAML tokens. A
remote attacker could possibly use this issue to bypass SAML token
signature verification and perform VMware Tools Guest Operations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   open-vm-tools                   2:12.1.5-3ubuntu0.23.04.2

Ubuntu 22.04 LTS:
   open-vm-tools                   2:12.1.5-3~ubuntu0.22.04.3

Ubuntu 20.04 LTS:
   open-vm-tools                   2:11.3.0-2ubuntu0~ubuntu20.04.6

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6365-1
   CVE-2023-20900

Package Information:
   https://launchpad.net/ubuntu/+source/open-vm-tools/2:12.1.5-3ubuntu0.23.04.2
   https://launchpad.net/ubuntu/+source/open-vm-tools/2:12.1.5-3~ubuntu0.22.04.3
 
https://launchpad.net/ubuntu/+source/open-vm-tools/2:11.3.0-2ubuntu0~ubuntu20.04.6

Ubuntu 6365-1: Open VM Tools vulnerability

September 13, 2023
Open VM Tools could allow unintended access to network services.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Open VM Tools could allow unintended access to network services. Software Description: - open-vm-tools: Open VMware Tools for virtual machines hosted on VMware Details: It was discovered that Open VM Tools incorrectly handled SAML tokens. A remote attacker could possibly use this issue to bypass SAML token signature verification and perform VMware Tools Guest Operations.

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: open-vm-tools 2:12.1.5-3ubuntu0.23.04.2 Ubuntu 22.04 LTS: open-vm-tools 2:12.1.5-3~ubuntu0.22.04.3 Ubuntu 20.04 LTS: open-vm-tools 2:11.3.0-2ubuntu0~ubuntu20.04.6 In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6365-1

CVE-2023-20900

Severity
Ubuntu Security Notice USN-6365-1

Package Information

https://launchpad.net/ubuntu/+source/open-vm-tools/2:12.1.5-3ubuntu0.23.04.2 https://launchpad.net/ubuntu/+source/open-vm-tools/2:12.1.5-3~ubuntu0.22.04.3 https://launchpad.net/ubuntu/+source/open-vm-tools/2:11.3.0-2ubuntu0~ubuntu20.04.6

Related News