Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2013.1152 VMware Workstation host privilege escalation vulnerability 23 August 2013 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: VMware Workstation VMware Player Publisher: VMware Operating System: Debian GNU/Linux Ubuntu Impact/Access: Root Compromise -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2013-1662 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - ----------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2013-0010 Synopsis: VMware Workstation host privilege escalation vulnerability Issue date: 2013-08-22 Updated on: 2013-08-22 (initial advisory) CVE numbers: CVE-2013-1662 - - ------------------------------------------------------------------------ 1. Summary VMware Workstation and VMware Player address a vulnerability in the vmware-mount component which could result in a privilege escalation on linux-based host machines. 2. Relevant releases VMware Workstation 9.x VMware Workstation 8.x VMware Player 5.x VMware Player 4.x 3. Problem Description a. VMware mount privilege escalation VMware Workstation and Player contain a vulnerability in the handling of the vmware-mount command. A local malicious user may exploit this vulnerability to escalate their privileges to root on the host OS. The issue is present when Workstation or Player are installed on a Debian-based version of Linux. The vulnerability does not allow for privilege escalation from the Guest Operating System to the host or vice-versa. This means that host memory can not be manipulated from the Guest Operating System. Workaround A workaround for the issue is to remove the setuid bit from vmware-mount: # chmod u-s /usr/bin/vmware-mount This workaround is relevant for both Workstation and Player. VMware would like to thank Tavis Ormandy from the Google Security Team for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-1662 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======= ======= ================= Workstation 9.x Linux * See section 4. Solution Workstation 8.x Linux * See section 4. Solution Player 4.x Linux * See section 4. Solution Player 5.x Linux * See section 4. Solution Fusion any Mac/OS Not affected ESXi any ESXi Not affected ESX any ESX Not affected * The issue is present if Workstation or Player is installed on a Debian-based version of Linux (e.g. Ubuntu). 4. Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. VMware Workstation 9.x, 8.x --------------------------- https://www.vmware.com/go/downloadworkstation To remediate the issue, replace /usr/bin/vmware-mount on the host with a fixed version present in the Drivers and Tools tab of the download page for Workstation listed above. VMware Player 5.x, 4.x --------------------------- https://www.vmware.com/go/downloadplayer To remediate the issue, replace /usr/bin/vmware-mount on the host with a fixed version present in the Drivers and Tools tab of the download page for Player listed above. 5. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1662 - - ----------------------------------------------------------------------- 6. Change log 2013-08-22 VMSA-2013-0010 Initial security advisory in conjunction with the release of an updated version of vmware-mount for Workstation 8 and Workstation 9 and Player 4 and Player 5. ----------------------------------------------------------------------- 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware security response policy http://www.vmware.com/support/policies/security_response.html General support life cycle policy http://www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html Copyright 2013 VMware Inc. All rights reserved. - -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.8.3 (Build 4028) Charset: utf-8 wj8DBQFSFu22DEcm8Vbi9kMRApVtAKCd57G2hqtFjw3T5RBN97zkekO6MQCguVQt zZuJlZNFzF580UTjF/2xY2s= =nkZ1 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUhcFahLndAQH1ShLAQLeeBAAp3wvU8vAo8S23Y2rb4kNLsa6N6VHCnzj o+AprXnxGQC+fToRu1JjXQ1Yjjz0cZDMn1uw4m4zi/nncWdSqvznRCDObRegOWUg RVFus+0L5C4f0ryzjJwlSo8Ir7+a4NDMVz5fYUHnmOhQlqajA9Cy4QfQlHAr3cUi i7pDKTR8Pt1QTa5m+IVI+ojEuzl8bdBZ7BxF2UPzfT7jJJ87Az5ZmEErTswEVSx0 dMB77ugr2nMh5bQeqQsa7Yv8Dc9KBCSP1WgTAeqHV9v6qrYCtFHzeK+DvXxEfREp gMxNSjMMe1FjyUwBeHRQyMAhq5WnFWcdnnzt2U/Yikoz2SpmuYQ+/Pn1upi9ThOb pZahCkDhUiR/q/VDKLgwZJb0UFIcIDQ9zBRvUhL8I2wSEvmBHyfRb8gAHROkJ/8C azGhb6OUjIQfd7s8vOp7a+llqNRQJkHredsynIGM85ieH4R1odUcmQ7fvIe0ZWNC Pe4IYgNLBpHNipd2ClBrbMncs/becIhdpKczcoBcpuZZrvNnBCfL50+JXeKqWonI lw3U7gTcYPopi6IdLmeVQta1Teyijqi0BEp/4LDzUOIAd2zeSq7uCdGsqQlkuJHz 9Jt3eDGrBqpCthNDmtXe+LJ8ToIPPw7BF2WJWpvpA7B8vK/GBBjLyISDPDYDew6B F88M5AIPOP4= =pv60 -----END PGP SIGNATURE-----