Apache-Talk @lexa.ru 

Inet-Admins @info.east.ru 

Filmscanners @halftone.co.uk 

Security-alerts @yandex-team.ru 

nginx-ru @sysoev.ru 

   


   


   

















      :: Security-alerts
Security-Alerts mailing list archive (security-alerts@yandex-team.ru)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[security-alerts] FW: [SA25079] VMware Workstation Multiple Vulnerabilities



> 
> TITLE:
> VMware Workstation Multiple Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA25079
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/25079/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> Security Bypass, DoS
> 
> WHERE:
> Local system
> 
> SOFTWARE:
> VMware Workstation 5.x
> http://secunia.com/product/5080/
> 
> DESCRIPTION:
> Some vulnerabilities have been reported in VMware Workstation, which
> can be exploited by malicious users to cause a DoS (Denial of
> Service) or bypass certain security restrictions.
> 
> 1) An error exists within the ACPI implementation of the virtual
> machine process (VMX) when collecting information about running
> states of virtual machines, which can be exploited to cause the
> process to read from invalid memory locations.
> 
> 2) An unspecified error exists within the VMX when storing certain
> malformed configuration data, which can be exploited to cause a DoS
> of guest operating systems.
> 
> 3) An unspecified error within the handling of general protection
> faults (GPFs) in Windows guest operating systems can be exploited to
> crash Windows virtual machines.
> 
> 4) Unspecified errors when debugging applications in a 64-bit Windows
> guest operating system on a 64-bit host system can be exploited to
> e.g. cause corrupted stack pointers or kernel bugchecks.
> 
> 5) A design error within the "Shared Folders" feature can be
> exploited in a guest system to read and write arbitrary files on a
> host system.
> 
> Successful exploitation requires that at least one folder is shared.
> In order to write to host files, the "read only" option of the shared
> folder has to be disabled.
> 
> SOLUTION:
> Update to VMware Workstation 5.5.4, Build 44386.
> http://www.vmware.com/download/ws/
> 
> PROVIDED AND/OR DISCOVERED BY:
> 1) Tavis Ormandy, Google
> 2) Sungard Ixsecurity
> 3) Ruben Santamarta, Reversemode
> 4) Ken Johnson
> 5) Greg MacManus, iDefense Labs
> 
> ORIGINAL ADVISORY:
> VMware:
> http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html#554
> 
> 5) iDefense Labs:
> http://labs.idefense.com/intelligence/vulnerabilities/display.
> php?id=521
> 



 




Copyright © Lexa Software, 1996-2009.