GLSA 201209-25: VMware Player, Server, Workstation: Multiple vulnerabilities

http://security.gentoo.org/

Опасность:	высокая
Заголовок:	VMware Player, Server, Workstation: Multiple vulnerabilities
Дата:	29.09.2012
Ошибки:	#213548, #224637, #236167, #245941, #265139, #282213, #297367, #335866, #385727
ID:	201209-25

Сводка

Multiple vulnerabilities have been found in VMware Player, Server, and Workstation, allowing remote and local attackers to conduct several attacks, including privilege escalation, remote execution of arbitrary code, and a Denial of Service.

Назначение

VMware Player, Server, and Workstation allow emulation of a complete PC on a PC without the usual performance overhead of most emulators.

Уязвимые пакеты

Пакет	Уязвимый	Архитектура(ы)
app-emulation/vmware-player	<= 2.5.5.328052	All supported architectures
app-emulation/vmware-workstation	<= 6.5.5.328052	All supported architectures
app-emulation/vmware-server	<= 1.0.9.156507	All supported architectures

Описание

Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details.

Воздействие

Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information.

A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.

Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).

Обход

There is no known workaround at this time.

Решение

Gentoo discontinued support for VMware Player. We recommend that users unmerge VMware Player:

      # emerge --unmerge "app-emulation/vmware-player"

NOTE: Users could upgrade to “>=app-emulation/vmware-player-3.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Workstation:


      # emerge --unmerge "app-emulation/vmware-workstation"

NOTE: Users could upgrade to “>=app-emulation/vmware-workstation-7.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Server. We recommend that users unmerge VMware Server:


      # emerge --unmerge "app-emulation/vmware-server"

Ссылки

CVE-2007-5269
CVE-2007-5503
CVE-2007-5671
CVE-2008-0967
CVE-2008-1340
CVE-2008-1361
CVE-2008-1362
CVE-2008-1363
CVE-2008-1364
CVE-2008-1392
CVE-2008-1447
CVE-2008-1806
CVE-2008-1807
CVE-2008-1808
CVE-2008-2098
CVE-2008-2100
CVE-2008-2101
CVE-2008-4915
CVE-2008-4916
CVE-2008-4917
CVE-2009-0040
CVE-2009-0909
CVE-2009-0910
CVE-2009-1244
CVE-2009-2267
CVE-2009-3707
CVE-2009-3732
CVE-2009-3733
CVE-2009-4811
CVE-2010-1137
CVE-2010-1138
CVE-2010-1139
CVE-2010-1140
CVE-2010-1141
CVE-2010-1142
CVE-2010-1143
CVE-2011-3868

Наличие

Этот GLSA и любые обновления для нее доступны для просмотра на сайте Gentoo Security: http://security.gentoo.org/glsa/glsa-201209-25.xml

Опасения?

Безопасность является одной из главных задач Gentoo Linux и первостепенное значение обеспечить конфиденциальность и безопасность машин наших пользователей. Любые соображения безопасности должны быть адресованы security@gentoo.org или в качестве альтернативы, вы можете сообщить об ошибке на https://bugs.gentoo.org.