GLSA 201209-25: VMware Player, Server, Workstation: Multiple vulnerabilities

http://security.gentoo.org/

Severity:	high
Title:	VMware Player, Server, Workstation: Multiple vulnerabilities
Date:	09/29/2012
Bugs:	#213548, #224637, #236167, #245941, #265139, #282213, #297367, #335866, #385727
ID:	201209-25

Synopsis

Multiple vulnerabilities have been found in VMware Player, Server, and Workstation, allowing remote and local attackers to conduct several attacks, including privilege escalation, remote execution of arbitrary code, and a Denial of Service.

Background

VMware Player, Server, and Workstation allow emulation of a complete PC on a PC without the usual performance overhead of most emulators.

Affected packages

Package	Vulnerable	Architecture(s)
app-emulation/vmware-player	<= 2.5.5.328052	All supported architectures
app-emulation/vmware-workstation	<= 6.5.5.328052	All supported architectures
app-emulation/vmware-server	<= 1.0.9.156507	All supported architectures

Description

Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details.

Impact

Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information.

A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.

Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).

Workaround

There is no known workaround at this time.

Resolution

Gentoo discontinued support for VMware Player. We recommend that users unmerge VMware Player:

      # emerge --unmerge "app-emulation/vmware-player"

NOTE: Users could upgrade to “>=app-emulation/vmware-player-3.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Workstation:


      # emerge --unmerge "app-emulation/vmware-workstation"

NOTE: Users could upgrade to “>=app-emulation/vmware-workstation-7.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Server. We recommend that users unmerge VMware Server:


      # emerge --unmerge "app-emulation/vmware-server"

References

CVE-2007-5269
CVE-2007-5503
CVE-2007-5671
CVE-2008-0967
CVE-2008-1340
CVE-2008-1361
CVE-2008-1362
CVE-2008-1363
CVE-2008-1364
CVE-2008-1392
CVE-2008-1447
CVE-2008-1806
CVE-2008-1807
CVE-2008-1808
CVE-2008-2098
CVE-2008-2100
CVE-2008-2101
CVE-2008-4915
CVE-2008-4916
CVE-2008-4917
CVE-2009-0040
CVE-2009-0909
CVE-2009-0910
CVE-2009-1244
CVE-2009-2267
CVE-2009-3707
CVE-2009-3732
CVE-2009-3733
CVE-2009-4811
CVE-2010-1137
CVE-2010-1138
CVE-2010-1139
CVE-2010-1140
CVE-2010-1141
CVE-2010-1142
CVE-2010-1143
CVE-2011-3868

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201209-25.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.