VMware Products Page Fault Exception Local Privilege Escalation Vulnerability
BID:36841
Info
VMware Products Page Fault Exception Local Privilege Escalation Vulnerability
| Bugtraq ID: | 36841 |
| Class: | Design Error |
| CVE: |
CVE-2009-2267 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 27 2009 12:00AM |
| Updated: | Oct 27 2009 09:18PM |
| Credit: | Tavis Ormandy and Julien Tinnes of the Google Security Team |
| Vulnerable: |
VMWare Workstation 6.5.3 VMWare Workstation 6.5.2 VMWare Workstation 6.5.1 VMWare Workstation 6.5 build 118166 VMWare Workstation 6.5.2 build 156735 VMWare Server 2.0.1 build 156745 VMWare Server 2.0.1 VMWare Server 1.0.9 build 156507 VMWare Server 1.0.9 VMWare Server 1.0.8 build 126538 VMWare Server 1.0.8 VMWare Server 1.0.7 build 108231 VMWare Server 1.0.7 VMWare Server 1.0.6 build 91891 VMWare Server 1.0.6 VMWare Server 1.0.5 Build 80187 VMWare Server 1.0.5 VMWare Server 1.0.4 VMWare Server 1.0.3 VMWare Server 1.0.2 VMWare Server 2.0 VMWare Player 2.5.3 VMWare Player 2.5.2 build 156735 VMWare Player 2.5.2 VMWare Player 2.5.1 VMWare Player 2.5 build 118166 VMWare Fusion 2.0.6 VMWare Fusion 2.0.5 VMWare Fusion 2.0.4 VMWare Fusion 2.0.3 VMWare Fusion 2.0.2 build 147997 VMWare Fusion 2 VMWare ESXi Server 4.0 VMWare ESXi Server 3.5 ESXe350-20090440 VMWare ESXi Server 3.5 VMWare ESX Server 3.0.3 ESX303-200905401-SG VMWare ESX Server 3.0.3 ESX303-200812406-BG VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.2 ESX-1008420 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.0 VMWare ESX Server 2.5.5 patch 9 VMWare ESX Server 2.5.5 patch 8 VMWare ESX Server 2.5.5 patch 6 VMWare ESX Server 2.5.5 patch 4 VMWare ESX Server 2.5.5 patch 2 VMWare ESX Server 2.5.5 patch 13 VMWare ESX Server 2.5.5 patch 12 VMWare ESX Server 2.5.5 patch 11 VMWare ESX Server 2.5.5 patch 10 VMWare ESX Server 2.5.5 VMWare ESX Server 2.5.4 Patch 5 VMWare ESX Server 2.5.4 Patch 3 VMWare ESX Server 2.5.4 patch 21 VMWare ESX Server 2.5.4 patch 19 VMWare ESX Server 2.5.4 Patch 17 VMWare ESX Server 2.5.4 Patch 16 VMWare ESX Server 2.5.4 patch 15 VMWare ESX Server 2.5.4 patch 13 VMWare ESX Server 2.5.4 Patch 10 VMWare ESX Server 2.5.4 Patch 1 VMWare ESX Server 2.5.4 VMWare ESX Server 2.5.3 Patch 8 VMWare ESX Server 2.5.3 Patch 7 VMWare ESX Server 2.5.3 Patch 6 VMWare ESX Server 2.5.3 Patch 5 VMWare ESX Server 2.5.3 Patch 4 VMWare ESX Server 2.5.3 Patch 13 VMWare ESX Server 2.5.3 VMWare ESX Server 2.5.2 VMWare ESX Server 2.5 VMWare ESX Server 2.1.3 Patch 8 VMWare ESX Server 2.1.3 Patch 5 VMWare ESX Server 2.1.3 Patch 4 VMWare ESX Server 2.1.3 Patch 2 VMWare ESX Server 2.1.3 VMWare ESX Server 2.1.2 VMWare ESX Server 2.1.1 VMWare ESX Server 2.1 VMWare ESX Server 2.0.2 Patch 8 VMWare ESX Server 2.0.2 Patch 5 VMWare ESX Server 2.0.2 Patch 4 VMWare ESX Server 2.0.2 Patch 2 VMWare ESX Server 2.0.2 VMWare ESX Server 2.0.1 build 6403 VMWare ESX Server 2.0.1 VMWare ESX Server 2.0 build 5257 VMWare ESX Server 2.0 VMWare ESX Server 4.0 VMWare ESX Server 4.0 VMWare ESX Server 3.5 ESX350-200906407 VMWare ESX Server 3.5 ESX350-200904401 VMWare ESX Server 3.5 VMWare ESX Server 2.5.5 patch 5 VMWare ESX Server 2.5.3 Patch 2 VMWare ESX Server 2.5.2 Patch 4 VMWare ESX Server 2.1.3 Patch 1 VMWare ESX Server 2.0.2 Patch 1 VMWare ACE 2.5.2 build 156735 VMWare ACE 2.5.2 VMWare ACE 2.5.1 VMWare ACE 2.5 build 118166 |
| Not Vulnerable: |
VMWare Workstation 6.5.3 build 185404 VMWare Server 2.0.2 Build 203138 VMWare Server 1.0.10 Build 203137 VMWare Player 2.5.3 build 185404 VMWare Fusion 2.0.6 Build 196839 VMWare ESXi Server 4.0 ESXi400-20090940 VMWare ESXi Server 3.5 ESXe350-20091040 VMWare ESX Server 3.0.3 ESX303-200910401-BG VMWare ESX Server 2.5.5 patch 15 VMWare ESX Server 4.0 ESX400-200909401 VMWare ESX Server 3.5 ESX350-200910401 VMWare ACE 2.5.3 Build 185404 |
Discussion
VMware Products Page Fault Exception Local Privilege Escalation Vulnerability
VMware products are prone to a privilege-escalation vulnerability because they fail to properly handle certain page faults.
An attacker can exploit this issue to run arbitrary code with superuser privileges. Successful attacks will completely compromise affected computers.
Note that this issue does not affect the host operating system.
VMware products are prone to a privilege-escalation vulnerability because they fail to properly handle certain page faults.
An attacker can exploit this issue to run arbitrary code with superuser privileges. Successful attacks will completely compromise affected computers.
Note that this issue does not affect the host operating system.
Exploit / POC
VMware Products Page Fault Exception Local Privilege Escalation Vulnerability
The following exploit code is available:
The following exploit code is available:
Solution / Fix
VMware Products Page Fault Exception Local Privilege Escalation Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
VMWare ESXi Server 3.5
VMWare ESX Server 3.5
VMWare Server 1.0.9
VMWare Player 2.5.2
Solution:
The vendor has released an advisory and updates. Please see the references for details.
VMWare ESXi Server 3.5
-
VMWare ESX350-200910401-SG (DHCP third party library, kernel)
http://download3.vmware.com/software/vi/ESX350-200910401-SG.zip -
VMWare ESXe350-200910401-O-SG.zip
ESXi 3.5 patch ESXe350-200910401-I-SG (Privilege Escalation)
http://download3.vmware.com/software/vi/ESXe350-200910401-O-SG.zip
VMWare ESX Server 3.5
-
VMWare ESX350-200910401-SG.zip
ESX 3.5 patch ESX350-200910401-SG (Privilege Escalation)
http://download3.vmware.com/software/vi/ESX350-200910401-SG.zip
VMWare Server 1.0.9
-
VMWare VMware-mui-1.0.10-203137.tar.gz
Management Interface
http://download3.vmware.com/software/vmserver/VMware-mui-1.0.10-203137 .tar.gz -
VMWare VMware-server-1.0.10-203137.i386.rpm
VMware Server for Linux rpm
http://download3.vmware.com/software/vmserver/VMware-server-1.0.10-203 137.i386.rpm -
VMWare VMware-server-1.0.10-203137.tar.gz
VMware Server for Linux
http://download3.vmware.com/software/vmserver/VMware-server-1.0.10-203 137.tar.gz -
VMWare VMware-server-installer-1.0.10-203137.exe
VMware Server for Windows 32-bit and 64-bit
http://download3.vmware.com/software/vmserver/VMware-server-installer- 1.0.10-203137.exe -
VMWare VMware-server-linux-client-1.0.10-203137.zip
VMware Server Linux client package
http://download3.vmware.com/software/vmserver/VMware-server-linux-clie nt-1.0.10-203137.zip -
VMWare VMware-server-win32-client-1.0.10-203137.zip
VMware Server Windows client package
http://download3.vmware.com/software/vmserver/VMware-server-win32-clie nt-1.0.10-203137.zip
VMWare Player 2.5.2
-
VMWare VMware-player-2.5.3-185404.exe
Player for Windows binary
http://download3.vmware.com/software/vmplayer/VMware-player-2.5.3-1854 04.exe -
VMWare VMware-Player-2.5.3-185404.i386.bundle
Player for Linux (.bundle)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-1854 04.i386.bundle -
VMWare VMware-Player-2.5.3-185404.i386.rpm
Player for Linux (.rpm)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-1854 04.i386.rpm -
VMWare VMware-Player-2.5.3-185404.x86_64.bundle
Player for Linux - 64-bit (.bundle)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-1854 04.x86_64.bundle -
VMWare VMware-Player-2.5.3-185404.x86_64.rpm
Player for Linux - 64-bit (.rpm)
http://download3.vmware.com/software/vmplayer/VMware-Player-2.5.3-1854 04.x86_64.rpm
References
VMware Products Page Fault Exception Local Privilege Escalation Vulnerability
References:
References: