Two VMware Vulnerabilities Found, Fixed -- Redmondmag.com

Two VMware Vulnerabilities Found, Fixed

By Joab Jackson
06/06/2008

A pair of vulnerabilities found in several VMware Linux products will require users to update these products to resecure their systems, security analysis firm iDefense announced yesterday.

In the first vulnerability, users can inject arbitrary code into a virtual environment when asked by the VMware program to specify a directory for shared library modules. The software's vmware-authd function grants the user root privilege for this transaction.

VMware Workstation Version 6.0.2.59824 for Linux, VMware GSX Server Version 3.2.1.14497 for Linux and VMware ESX Server 3.0.1.32039 (which does not require an operating system to run) are vulnerable.

VMware has updated its software to eliminate this vulnerability. Alternatively, iDefense recommends modifying the file permissions for the vmware-authd set-uid binary, either eliminating root access entirely or restricting its use to trusted groups.

The second vulnerability, discovered by Stephen Fewer at Harmony Security, occurs in VMware Workstation 5.5.4 with the VMware Tools package installed when it runs a guest version of Windows. This flaw allows an unprivileged user to send arbitrary code to the Windows kernel through a VMware driver called hgfs.sys, which has no access controls.

"With specially constructed input, a malicious user can use functionality within the driver to patch kernel addresses and execute arbitrary code in kernel mode," the iDefense bulletin stated.

VMware has issued a patch to correct the problem. Removal of the Tools package would also eliminate the vulnerability.

Both vulnerabilities have been been submitted to the Common Vulnerabilities and Exposures (CVE) standardized list of names for security issues. The first has been issued the identifier CVE-2008-0967 and the second CVE-2007-5671.

According to iDefense, VMware was notified about the vmware-authd vulnerability on Jan. 30 and the Tools vulnerability on Sept. 19. In both cases, the company responded the same day. The two companies issued a joint public disclosure on the vulnerabilities yesterday.

About the Author

Joab Jackson is the chief technology editor of Government Computing News (GCN.com).

Featured

What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.
Microsoft Kills 30-Day Data Retention Policy for Copilot in Fabric

Microsoft this week announced several usability improvements coming to Copilot in Fabric in preparation of its general availability release later this year.
Using Microsoft Office to Build a Network Diagram 2

Now that we've set up our process, let's dig in with the actual execution.
Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.
Fallout from Microsoft's 'Midnight Blizzard' Saga Hits Feds

When the Russian attack group Midnight Blizzard successfully breached Microsoft corporate e-mail accounts late last year, it apparently managed to steal U.S. government agency e-mails, too.