Gentoo Logo

VMware Player, Server, Workstation: Multiple vulnerabilities

Content:

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 201209-25 / vmware-server vmware-player vmware-workstation
Release Date September 29, 2012
Latest Revision September 29, 2012: 2
Impact high
Exploitable local, remote
Package Vulnerable versions Unaffected versions Architecture(s)
app-emulation/vmware-player <= 2.5.5.328052 All supported architectures
app-emulation/vmware-workstation <= 6.5.5.328052 All supported architectures
app-emulation/vmware-server <= 1.0.9.156507 All supported architectures

Related bugreports: #213548, #224637, #236167, #245941, #265139, #282213, #297367, #335866, #385727

Synopsis

Multiple vulnerabilities have been found in VMware Player, Server, and Workstation, allowing remote and local attackers to conduct several attacks, including privilege escalation, remote execution of arbitrary code, and a Denial of Service.

2.  Impact Information

Background

VMware Player, Server, and Workstation allow emulation of a complete PC on a PC without the usual performance overhead of most emulators.

Description

Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details.

Impact

Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information.

A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.

Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

Gentoo discontinued support for VMware Player. We recommend that users unmerge VMware Player:

Code Listing 3.1: Resolution

  # emerge --unmerge "app-emulation/vmware-player"

NOTE: Users could upgrade to “>=app-emulation/vmware-player-3.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Workstation:

Code Listing 3.2: Resolution

  # emerge --unmerge "app-emulation/vmware-workstation"

NOTE: Users could upgrade to “>=app-emulation/vmware-workstation-7.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Server. We recommend that users unmerge VMware Server:

Code Listing 3.3: Resolution

  # emerge --unmerge "app-emulation/vmware-server"

4.  References



Print

Page updated September 29, 2012

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.