-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Reference: CERT-EU Security Advisory 2012-0128 Title: VMware Hosted Products and OVF Tool address security issues Version history: 16.11.2012 Initial publication Summary ======= VMware Hosted products and OVFTool patches address several security issues. CVE-2012-5458, CVE-2012-5459 and CVE-2012-3569 Vulnerable systems ================== OVF Tool 2.1 Workstation 8.0.4 Player 4.0.4 Original Details ================ a. VMware Workstation and Player Weak permissions on process threads vulnerability. Certain processes when created have weak security permissions assigned. It is possible to commandeer these process threads, which could result in Elevation of Privilege in the context of the host. VMware would like to thank Derek Soeder of Cylance, Inc. for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-5458 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= vCenter any Windows not affected Workstation 9.x any not affected Workstation 8.x Windows 8.0.5 Workstation 8.x Linux not affected Player 5.x any not affected Player 4.x Windows 4.0.5 or later Player 4.x Linux not affected Fusion any Mac not affected ESXi any ESXi not affected ESX any ESX not affected b. VMware Workstation and Player DLL binary planting vulnerability. Workstation and Player have a binary planting vulnerability. An attacker who can write their malicious executable to a system folder on the host, may be able to run code under certain circumstances. VMware would like to thank Derek Soeder of Cylance, Inc. for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-5459 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= vCenter any Windows not affected Workstation 9.x any not affected Workstation 8.x Windows 8.0.5 Workstation 8.x Linux not affected Player 5.x any not affected Player 4.x Windows 4.0.5 or later Player 4.x Linux not affected Fusion any Mac not affected ESXi any ESXi not affected ESX any ESX not affected c. VMware OVF Tool format string vulnerability. The OVFTool has a format string vulnerability. Exploitation of this issue may lead to code execution. In order to exploit the issue, the attacker would need to trick the user into loading their malicious OVF file. It is recommended that only OVF files from trusted sources should be used. VMware would like to thank Jeremy Brown of Microsoft for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-3569 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ============= ======== ======= ================= vCenter any Windows not affected OVF Tool 3.x any not affected OVF Tool 2.1 Windows OVF Tool 3.0.1 OVF Tool 2.1 Linux/Mac not affected OVF Tool 2.0 any not affected Workstation 9.x any not affected Workstation 8.x Windows 8.0.5 Workstation 8.x Linux not affected Player 5.x any not affected Player 4.x Windows 4.0.5 or later Player 4.x Linux not affected Fusion any Mac not affected ESXi any ESXi not affected ESX any ESX not affected Note: Workstation, Player and the vSphere Web Client (part of vCenter Server) use the OVF Tool to load OVF files. Other products, including vCenter Server (except vSPhere Web Client), ESX, and vCloud Director do not use the OVF Tool to parse OVF files. What can you do? ================ Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. OVF Tool 3.0.1 ------------ https://www.vmware.com/support/developer/ovf/ VMware Workstation 8.0.5 --------------------------- https://www.vmware.com/go/downloadworkstation Release notes: https://www.vmware.com/support/ws80/doc/releasenotes_workstation_805.html Player 4.0.5 --------------------------- http://www.vmware.com/go/downloadplayer Release notes: https://www.vmware.com/support/player40/doc/releasenotes_player405.html What to tell your users? ======================== N/A More information ================ [1] http://www.vmware.com/security/advisories/VMSA-2012-0015.html [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5458 [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5459 [4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3569 [5] More information about CVSS is available at: http://www.first.org/cvss/cvss-guide.html [6] https://www.vmware.com/support/developer/ovf/ [7] https://www.vmware.com/go/downloadworkstation [8] https://www.vmware.com/go/downloadplayer Best regards, CERT-EU Pre-configuration Team (http://cert.europa.eu) Phone: +32.2.2990005 / e-mail: cert-eu@ec.europa.eu PGP KeyID 0x46AC4383 FP: 9011 6BE9 D642 DD93 8348 DAFA 27A4 06CA 46AC 4383 Privacy Statement: http://cert.europa.eu/cert/plainedition/en/cert_privacy.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBAgAGBQJQqgfUAAoJEPpzpNLI8SVoJ4UP/iknWkpnMmj3o10PmwqOvIeF /aqoEN3G87JANCf4xmjMA3ZKMOHU4cJmcyokmDVK3xV4Njc/x/4LSKiSjeUdOUW6 7S670E/n5lU78fmH2oNvZNOY/kuNPazXjNC+koJpvwtLYkUcU+YUcAQEybhcblL3 qC4wcLbXHrpOEi4HUT+QmM5kc+s3JAcgPuawRyzJoo0zGd/w25USMBvR2r7K4/y8 BjhjSqI91wyvNkU1M1s1xtx86Ougqg3l2kL9JmfVasGSHLDM/fUEDjqAWYdAwMIU HDvwumFW0KWYnbQzh9TAxrWgaH9bHuT6bRII0apkl2GK9X4xt2CAnOU/aX/PPE3N 6Ht0fXEXEfS3UyCbksRvdwLS3ylgl2SBKvUjEQW84IqIr5XNic6DwBQj6dtGb9b0 jwtBz+t2ZnTUIeiJQro8daJZWeB4Fey6AAO3GgGrWuQIRMJtI1V/Q4cFW9KHbIeu qRqI1Cto6R2xBpOP2IcdUuNslh9Pa2+5/IaCts9JUvLlvF0O4QlKoRfewk5cYTQn jryqdY6CMjCw3ewGDdA3pVsSTAw59kE9pp1mIQGTHTcmkS+cZWQS96yguCluzqrg fSog2bpFUxJ65PFUFhogj37DLyPQOq7fzu1i2o4DcZoPVlcndxru4Fg9FrvXp+rC zo3qyajcNwlBOR5wc2NR =BApe -----END PGP SIGNATURE-----