VMware Workstation and Player: Multiple vulnerabilities

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200711-23 / vmware-workstation vmware-player
Release Date	November 18, 2007
Latest Revision	April 16, 2008: 03
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
app-emulation/vmware-workstation	< 5.5.5.56455, = 6.0.0.45731	>= 5.5.5.56455	All supported architectures
app-emulation/vmware-player	< 1.0.5.56455, = 2.0.0.45731	>= 1.0.5.56455	All supported architectures

Related bugreports: #193196

Synopsis

VMware guest operating systems might be able to execute arbitrary code with elevated privileges on the host operating system through multiple flaws.

2. Impact Information

Background

VMware Workstation is a virtual machine for developers and system administrators. VMware Player is a freeware virtualization software that can run guests produced by other VMware products.

Description

Multiple vulnerabilities have been discovered in several VMware products. Neel Mehta and Ryan Smith (IBM ISS X-Force) discovered that the DHCP server contains an integer overflow vulnerability (CVE-2007-0062), an integer underflow vulnerability (CVE-2007-0063) and another error when handling malformed packets (CVE-2007-0061), leading to stack-based buffer overflows or stack corruption. Rafal Wojtczvk (McAfee) discovered two unspecified errors that allow authenticated users with administrative or login privileges on a guest operating system to corrupt memory or cause a Denial of Service (CVE-2007-4496, CVE-2007-4497). Another unspecified vulnerability related to untrusted virtual machine images was discovered (CVE-2007-5617).

VMware products also shipped code copies of software with several vulnerabilities: Samba (GLSA-200705-15), BIND (GLSA-200702-06), MIT Kerberos 5 (GLSA-200707-11), Vixie Cron (GLSA-200704-11), shadow (GLSA-200606-02), OpenLDAP (CVE-2006-4600), PAM (CVE-2004-0813, CVE-2007-1716), GCC (CVE-2006-3619) and GDB (CVE-2006-4146).

Impact

Remote attackers within a guest system could possibly exploit these vulnerabilities to execute code on the host system with elevated privileges or to cause a Denial of Service.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All VMware Workstation users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/vmware-workstation-5.5.5.56455"

All VMware Player users should upgrade to the latest version:

Code Listing 3.2: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/vmware-player-1.0.5.56455"

4. References

Updated November 18, 2007

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.