VMware Products Shared Folders 'MultiByteToWideChar()' Variant Directory Traversal Vulnerability
BID:27944
Info
VMware Products Shared Folders 'MultiByteToWideChar()' Variant Directory Traversal Vulnerability
| Bugtraq ID: | 27944 |
| Class: | Access Validation Error |
| CVE: |
CVE-2008-0923 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 24 2008 12:00AM |
| Updated: | Mar 18 2008 03:01PM |
| Credit: | Core Security Technologies reported this issue. |
| Vulnerable: |
VMWare Workstation 6.0.2 VMWare Workstation 6.0.1 VMWare Workstation 6.0 VMWare Workstation 5.5.5 VMWare Workstation 5.5.4 build 44386 VMWare Workstation 5.5.4 VMWare Workstation 5.5.3 build 42958 VMWare Workstation 5.5.3 build 34685 VMWare Workstation 4.5.2 VMWare Server 1.0.4 VMWare Server 1.0.3 VMWare Server 1.0.2 VMWare Player 2.0.2 VMWare Player 2.0.1 VMWare Player 2.0 VMWare Player 1.0.4 VMWare Player 1.0.3 VMWare Player 1.0.2 VMWare Player 1.0.1 Build 19317 VMWare ACE 2.0.2 VMWare ACE 2.0.1 VMWare ACE 2.0 VMWare ACE 1.0.2 VMWare ACE 1.0 |
| Not Vulnerable: |
VMWare Workstation 6.0.3 Build 80004 VMWare Workstation 6.0.3 VMWare Workstation 5.5.6 Build 80404 VMWare Server 1.0.5 VMWare Player 2.0.3 Build 80004 VMWare Player 1.0.6 Build 80404 VMWare ACE 2.0.3 VMWare ACE 1.0.5 |
Discussion
VMware Products Shared Folders 'MultiByteToWideChar()' Variant Directory Traversal Vulnerability
Multiple VMware products are prone to a directory-traversal vulnerability that affects shared folders.
Attackers who can access a guest operating system can exploit this issue to gain full read and write access to the filesystem of the host operating system. Successful attacks could compromise the affected host OS. Other attacks are possible.
NOTE: This vulnerability occurs only on Windows hosts when 'Shared Folders' is enabled and when a shared folder exists.
The issue affects the following:
VMware Workstation 6.0.2, 5.5.4, and earlier
VMware Player 2.0.2, 1.0.4, and earlier
VMware ACE 2.0.2, 1.0.2, and earlier.
NOTE: This issue occurs because of a fix that was introduced to address a similar issue (CVE-2007-1744) that is documented in BID 23721 (VMware Workstation Shared Folders Directory Traversal Vulnerability).
Multiple VMware products are prone to a directory-traversal vulnerability that affects shared folders.
Attackers who can access a guest operating system can exploit this issue to gain full read and write access to the filesystem of the host operating system. Successful attacks could compromise the affected host OS. Other attacks are possible.
NOTE: This vulnerability occurs only on Windows hosts when 'Shared Folders' is enabled and when a shared folder exists.
The issue affects the following:
VMware Workstation 6.0.2, 5.5.4, and earlier
VMware Player 2.0.2, 1.0.4, and earlier
VMware ACE 2.0.2, 1.0.2, and earlier.
NOTE: This issue occurs because of a fix that was introduced to address a similar issue (CVE-2007-1744) that is documented in BID 23721 (VMware Workstation Shared Folders Directory Traversal Vulnerability).
Exploit / POC
VMware Products Shared Folders 'MultiByteToWideChar()' Variant Directory Traversal Vulnerability
Attackers can exploit this issue using readily available utilities. Please see the referenced security advisory CORE-2007-0930 for information on how attackers may successfully exploit this issue.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Attackers can exploit this issue using readily available utilities. Please see the referenced security advisory CORE-2007-0930 for information on how attackers may successfully exploit this issue.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
VMware Products Shared Folders 'MultiByteToWideChar()' Variant Directory Traversal Vulnerability
Solution:
The vendor released fixes to address these issues. Please see the references for more information.
Solution:
The vendor released fixes to address these issues. Please see the references for more information.
References
VMware Products Shared Folders 'MultiByteToWideChar()' Variant Directory Traversal Vulnerability
References:
References:
- Critical VMware security alert for Windows-hosted VMware client versions (SANS)
- VMware Homepage (VMware)
- VMware Server Release Notes (VMware)
- VMware Workstation 6.0 Release Notes (VMware)
- CORE-2007-0930 Path Traversal vulnerability in VMware's shared folders implement (Core Security Technologies Advisories
- Critical VMware Security Alert for Windows-Hosted VMware Workstation, VMware Pla (VMware)