Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2010-4295: [Security-announce] VMSA-2010-0018 VMware hosted products and ESX patches resolve multiple security issues

Race condition in the mounting process in vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 allows host OS users to gain privileges via vectors involving temporary files.

CVE
Open in Source
#vulnerability#web#mac#windows#microsoft#linux#intel#rce#vmware#auth

VMware Security Announcements security-announce at lists.vmware.com
Thu Dec 2 22:53:35 PST 2010

  • Previous message: [Security-announce] VMSA-2010-0017 VMware ESX third party update for Service Console kernel
  • Next message: [Security-announce] VMSA-2010-0019 VMware ESX third party updates for Service Console
  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

               VMware Security Advisory

Advisory ID: VMSA-2010-0018 Synopsis: VMware hosted products and ESX patches resolve multiple security issues Issue date: 2010-12-02 Updated on: 2010-12-02 (initial release of advisory) CVE numbers: CVE-2010-4295 CVE-2010-4296 CVE-2010-4297 CVE-2010-4294

  1. Summary

    VMware hosted products and ESX patches resolve multiple security issues.

  2. Relevant releases

    VMware Workstation 7.1.1 and earlier, VMware Workstation 6.5.4 and earlier, VMware Player 3.1.1 and earlier, VMware Player 2.5.4 and earlier,

    VMware Fusion 3.1.1 and earlier,

    ESXi 4.1 without patch ESXi410-201010402-BG or later ESXi 4.0 without patch ESXi400-201009402-BG or later ESXi 3.5 without patch ESXe350-201008402-T-BG or later

    ESX 4.1 without patch ESX410-201010405-BG ESX 4.0 without patch ESX400-201009401-SG ESX 3.5 without patch ESX350-201008409-BG

    Note: VMware Server was declared End Of Availability on January 2010, support will be limited to Technical Guidance for the duration of the support term.

  3. Problem Description

a. VMware Workstation, Player and Fusion vmware-mount race condition

The way temporary files are handled by the mounting process could
result in a race condition. This issue could allow a local user on
the host to elevate their privileges.

VMware Workstation and Player running on Microsoft Windows are not
affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4295 to this issue.

VMware would like to thank Dan Rosenberg for reporting this issue.

The following table lists what action remediates the vulnerability
(column 4) if a solution is available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
VirtualCenter  any       Windows  not affected

Workstation    7.x       Linux    7.1.2 Build 301548 or later
Workstation    7.x       Windows  not affected
Workstation    6.5.x     any      not affected

Player         3.1.x     Linux    3.1.2 Build 301548 or later
Player         3.1.x     Windows  not affected
Player         2.5.x     any      not affected

AMS            any       any      not affected

Server         2.0.2     Linux    affected, no patch planned
Server         2.0.2     Windows  not affected

Fusion         3.1.x     Mac OS/X 3.1.2 Build 332101 or later
Fusion         2.x       Mac OS/X not affected

ESXi           any       ESXi     not affected

ESX            any       ESX      not affected

b. VMware Workstation, Player and Fusion vmware-mount privilege escalation

vmware-mount which is a suid binary has a flaw in the way libraries
are loaded.  This issue could allow local users on the host to
execute arbitrary shared object files with root privileges.

VMware Workstation and Player running on Microsoft Windows are not
affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4296 to this issue.

VMware would like to thank Martin Carpenter for reporting this
issue.

The following table lists what action remediates the vulnerability
(column 4) if a solution is available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
VirtualCenter  any       Windows  not affected

Workstation    7.x       Linux    7.1.2 Build 301548 or later
Workstation    7.x       Windows  not affected
Workstation    6.5.x     any      not affected

Player         3.1.x     Linux    3.1.2 Build 301548 or later
Player         3.1.x     Windows  not affected
Player         2.5.x     any      not affected

AMS            any       any      not affected

Server         2.0.2     Linux    affected, no patch planned
Server         2.0.2     Windows  not affected

Fusion         3.1.x     Mac OS/X 3.1.2 Build 332101
Fusion         2.x       Mac OS/X not affected

ESXi           any       ESXi     not affected

ESX            any       ESX      not affected

c. OS Command Injection in VMware Tools update

A vulnerability in the input validation of VMware Tools update
allows for injection of commands. The issue could allow a  user
on the host to execute commands on the guest operating system
with root privileges.

The issue can only be exploited if VMware Tools is not fully
up-to-date.  Windows-based virtual machines are not affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4297 to this issue.

VMware would like to thank Nahuel Grisolia of Bonsai Information
Security, http://www.bonsai-sec.com, for reporting this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
VirtualCenter  any       Windows  not affected

Workstation    7.x       any      7.1.2 Build 301548 or later
Workstation    6.5.x     any      6.5.5 Build 328052 or later

Player         3.1.x     any      3.1.2 Build 301548 or later
Player         2.5.x     any      2.5.5 Build 328052 or later

AMS            any       any      not affected

Server         2.0.2     any      affected, no patch planned

Fusion         3.1.x     Mac OS/X 3.1.2 Build 332101
Fusion         2.x       Mac OS/X 2.0.8 Build 328035

ESXi           4.1       ESXi     ESXi410-201010402-BG
ESXi           4.0       ESXi     ESXi400-201009402-BG
ESXi           3.5       ESXi     ESXe350-201008402-T-BG \*\*

ESX            4.1       ESX      ESX410-201010405-BG
ESX            4.0       ESX      ESX400-201009401-SG
ESX            3.5       ESX      ESX350-201008409-BG \*\*
ESX            3.0.3     ESX      not affected

* hosted products are VMware Workstation, Player, ACE, Fusion. ** Non Windows-based guest systems on ESXi 3.5 and ESX 3.5 only: - Install the relevant ESX patch. - Manually upgrade tools in the virtual machine (virtual machine users will not be prompted to upgrade tools). Note the VI Client may not show that the VMware tools is out of date in the summary tab.

d. VMware VMnc Codec frame decompression remote code execution

The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.

A function in the decoder frame decompression routine implicitly
trusts a size value.  An attacker can utilize this to miscalculate
a destination pointer, leading to the corruption of a heap buffer,
and could allow for execution of arbitrary code with the privileges
of the user running an application utilizing the vulnerable codec.

For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4294 to this issue.

VMware would like to thank Aaron Portnoy and Logan Brown of
TippingPoint DVLabs for reporting this issue.

Column 4 of the following table lists the action required to
remediate the vulnerability in each release, if a solution is
available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
VirtualCenter  any       Windows  not affected

Movie Decoder  any       Windows  7.1.2 Build 301548 or later
Movie Decoder  any       Windows  6.5.5 Build 328052 or later

Workstation    7.x       Windows  7.1.2 Build 301548 or later
Workstation    7.x       Linux    not affected
Workstation    6.5.x     Windows  6.5.5 build 328052 or later
Workstation    6.5.x     Linux    not affected

Player         3.x       Windows  3.1.2 Build 301548 or later
Player         3.x       Linux    not affected
Player         2.5.x     Windows  2.5.5 build 246459 or later
Player         2.5.x     Linux    not affected

AMS            any       any      not affected

Server         2.x       Window   affected, no patch planned
Server         2.x       Linux    not affected

Fusion         any       Mac OS/X not affected

ESXi           any       ESXi     not affected

ESX            any       ESX      not affected

  1. Solution Please review the patch/release notes for your product and version and verify the md5sum and/or the sha1sum of your downloaded file.

    VMware Workstation Movie Decoder

    Workstation 7.1.2 Movie Decoder md5sum: a4d761a21670c735d04abb89e674656e sha1sum: b66673c30f3b8b8fb18035d08a6255f478be875d

    Workstation 6.5.5 Movie Decoder build 328052 md5sum: 1223bb57d97df39259be2c6c90a65ba6 sha1sum: 3ae7cdeeeebf6a716ec73f934077545945474ff6

VMware Workstation 7.1.3

http://www.vmware.com/download/ws/ Release notes: http://downloads.vmware.com/support/ws71/doc/releasenotes_ws713.html

Workstation for Windows 32-bit and 64-bit with VMware Tools md5sum: 7b9dc01bf733047a00711f5800df6107 sha1sum: 5f36117c64455f3dff3b7410a0bfc72e41905181

Workstation for Windows 32-bit and 64-bit without VMware Tools md5sum: d102006f7a3951dd58325f5b4e151abe sha1sum: ccfd70278d3c89b38776d656fa797ca8e9b28d55

Workstation 6.5.5

http://www.vmware.com/download/ws/ Release notes: http://downloads.vmware.com/support/ws65/doc/releasenotes_ws655.html

Workstation for Windows 32-bit and 64-bit md5sum: 7bff9b621529efb0de808a45e7821274 sha1sum: 41af7a9a78717cb85dd30b4d830e99fd5de49cc1

Workstation for Linux 32-bit (rpm) md5sum: 17c3f1a0e6ccf2b1e224a5d75c845a47 sha1sum: 3027b4e2215fae84fa9311f8cd762fee17e89df0

Workstation for Linux 32-bit (bundle) md5sum: 7c24811fb999204f144d8b9f50e9fcae sha1sum: 18a05e6f4f772b7f0563dbd17596b66d1db8e9fa

Workstation for Linux 64-bit (rpm) md5sum: c25c2535d8091c4d46701ed081347901 sha1sum: f4356bc224ea9805dac2d4b677f88a2f4220353e

Workstation for Linux 64-bit (bundle) md5sum: 7012bdaf182d256672ff2eb24b00a40f sha1sum: 58ecb2a494d4c7cc663e2028cf76c13d458fecac

VMware Player 3.1.3

http://www.vmware.com/download/player/ Release notes:

http://downloads.vmware.com/support/player31/doc/releasenotes_player313.html

VMware Player for Windows 32-bit and 64-bit
md5sum: bd66a0ab8ae87d5cfa32b8ff44f99d1f sha1sum: 8ab358efc97a64639cce83766c35d43b0d662132

VMware Player for Linux 32-bit (bundle) md5sum: e5d0bf19a1908262f63a8f88df77f73e sha1sum: 4abb87d37706c47a86337ada1d23d390455e4931

VMware Player for Linux 64-bit (bundle) md5sum: 18e6aae025ee2ef9f10ce6d9271ce472 sha1sum: 6608bce64811be4480e667726aefefdc2b71e4e3

VMware Player 2.5.5

VMware Player 2.5.5 for Windows 32-bit and 64-bit md5sum: 780b2c4e2b1610dea3090b1cd81d5ad7 sha1sum: f6c451a11a4fe66e5a465de960de1358e83b8314

VMware Player 2.5.5 for Linux 32-bit (rpm) md5sum: 9e13ee3904bd2377ffb8cfa66460fe92 sha1sum: 2482acad19f6b23cf0c236d1ce87d4805b7b0e6c

VMware Player 2.5.5 for Linux 32-bit (bundle) MD5SUM: 46dcfe9343f688d60e249d9e9c3853a4 SHA1SUM: abfdeaf2cac83c630662607e7b95439367376abf

VMware Player 2.5.5 for Linux 64-bit (rpm) MD5SUM: 52d6dcdeed9e564c8cfe8c35cec885f0 SHA1SUM: dbaa6dac55f592b9c6b16d7505796a2580836f4b

VMware Player 2.5.5 for Linux 64-bit (bundle) md5sum: 6c9a677820010ccd20f829cb5d2c057b sha1sum: ff6eccba3125229e8adbc1cb96764c2f116d89c5

VMware Fusion

VMware Fusion 3.1.2 build 332101 md5sum: a809170c9bd55a102c007c20269c4729 sha1sum: bf56e0f873d8e0d67fd73fba5e597e0931083e03

VMware Fusion Lite 3.1.2 build 332101 md5sum: d7db517cb25320152723f8535c90dd16 sha1sum: 555d9bd03327731270acfc851ba15b28ef3f6720

VMware Fusion 2.0.8 (for Intel-based Macs) md5sum: 9951d3b7985c39c685d59eaa73fe267c sha1sum: 11463924b5a7f82161090416905774da45e1cd3e

VMware Fusion Lite 2.0.8 (for Intel-based Macs) md5sum: 0bee2ef0d0e9e543b2468ed9618e32c8 sha1sum: fa56bb7ea3493d07610051f92b9941305a436a2f

ESXi 4.1

ESXi410-201010001 Download link: https://hostupdate.vmware.com/software/VUM/OFFLINE/release-251-20101108-239087/ESXi410-201010001.zip md5sum: 05f1049c7a595481cd682e92fe8d3285 sha1sum: f6993c185f7d1cb971a4ae6e017e0246b8c25a76 http://kb.vmware.com/kb/1027753

Note ESXi410-201010001 contains the following security fix: ESXi410-201010402-BG

ESXi 4.0

ESXi400-201009001 Download link: https://hostupdate.vmware.com/software/VUM/OFFLINE/release-241-20100919-436526/ESXi400-201009001.zip md5sum: bfc1b78f14d970c556b828492f5920e1 sha1sum: a311a4af41aa1202bb6b156694bbc045c67df91a http://kb.vmware.com/kb/1025322

Note ESXi400-201009001 contains the following security fix: ESXi400-201009402-BG

ESXi 3.5

ESXe350-201008401-O-SG http://download3.vmware.com/software/vi/ESXe350-201008401-O-SG.zip md5sum:a2bb0afbc677ba847bedecb44dbdd4b3 http://kb.vmware.com/kb/1026139

Note ESXe350-201008401-O-SG contains the following security fix: ESXe350-201008402-T-BG

ESX 4.1

ESX410-201010001

https://hostupdate.vmware.com/software/VUM/OFFLINE/release-252-20101109-182791/ESX410-201010001.zip md5sum: ff4435fd3c74764f064e047c6e5e7809 sha1sum:322981f4dbb9e5913c8f38684369444ff7e265b3 http://kb.vmware.com/kb/1027027

ESX410-201010001 contains the following security fix: ESX410-201010405-BG

ESX 4.0

ESX400-201009001

https://hostupdate.vmware.com/software/VUM/OFFLINE/release-240-20100919-359479/ESX400-201009001.zip md5sum: 988c593b7a7abf0be5b72970ac64a369 sha1sum: 26d875955b01c19f4e56703216e135257c08836f http://kb.vmware.com/kb/1025321

ESX400-201009001 contains the following security fix: ESX400-201009401-SG

ESX 3.5

ESX350-201008409-BG http://download3.vmware.com/software/vi/ESX350-201008409-BG.zip md5sum: f2c4a4a53695057de25f095029d713fb http://kb.vmware.com/kb/1026133

  1. References

    CVE numbers http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4295 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4296 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4297 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4294

  1. Change log

2010-12-02 VMSA-2010-0018 Initial security advisory after release of Workstation 6.5.5, Player 2.5.5, Fusion 2.0.8 and Fusion 3.1.2 on 2010-12-02, ESX patches and Workstation 7.1.2 and 7.1.3 were released previously.

  1. Contact

E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

* security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk

E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055

VMware Security Center http://www.vmware.com/security

VMware Security Advisories http://www.vmware.com/security/advisories

VMware security response policy http://www.vmware.com/support/policies/security_response.html

General support life cycle policy http://www.vmware.com/support/policies/eos.html

VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html

Copyright 2010 VMware Inc. All rights reserved.

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32)

iEYEARECAAYFAkz4k+0ACgkQS2KysvBH1xkwLQCfaxJEaZ/nBDWpl0Pz3a3jBib1 0g0AmwfzyLSLYGEGt0RqmlYUy4vgD2bv =SgRb -----END PGP SIGNATURE-----

  • Previous message: [Security-announce] VMSA-2010-0017 VMware ESX third party update for Service Console kernel
  • Next message: [Security-announce] VMSA-2010-0019 VMware ESX third party updates for Service Console
  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

More information about the Security-announce mailing list

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE
CVE-2023-6905
CVE
CVE-2023-6903
CVE
CVE-2023-6904
CVE
CVE-2023-3907
CVE