Multiple VMware products 'Mount.vmhgfs' Mutiple Security Vulnerabilities

Bugtraq ID:	48098
Class:	Unknown
CVE:	CVE-2011-1787 CVE-2011-2145 CVE-2011-2146
Remote:	No
Local:	Yes
Published:	Jun 03 2011 12:00AM
Updated:	Jun 03 2011 06:40PM
Credit:	Dan Rosenberg
Vulnerable:	VMWare Workstation 7.1.3 VMWare Workstation 7.1.1 VMWare Workstation 7.1.2 VMWare Player 3.1.3 VMWare Player 3.1.2 VMWare Player 3.1 VMWare Player 3.1.1 VMWare Fusion 3.1 VMWare Fusion 3.1.2 VMWare Fusion 3.1.1 VMWare ESXi 4.1 VMWare ESXi 4.0 VMWare ESXi 3.5 VMWare ESX 4.1 VMWare ESX 4.0 VMWare ESX 3.5
Not Vulnerable:	VMWare Workstation 7.1.4 VMWare Player 3.1.4 VMWare Fusion 3.1.3 VMWare ESXi ESXi410-201104402-BG VMWare ESXi ESXi400-201104402-BG VMWare ESXi ESXe350-201105402-T- VMWare ESX ESX410-201104401-SG VMWare ESX ESX400-201104401-SG VMWare ESX ESX350-201105406-SG

Multiple VMware products 'Mount.vmhgfs' Mutiple Security Vulnerabilities

Multiple VMware products are prone to multiple security vulnerabilities, including an information-disclosure vulnerability and multiple privilege-escalation vulnerabilities.

These issues may allow attackers to gain access to potentially sensitive information and acquire elevated privileges; this may aid in further attacks.

The following versions are vulnerable:

VMware Workstation 7.1.x for Linux and Windows
VMware Player 3.1.x for Linux and Windows
VMware Fusion 3.1.x for OSX
VMware ESXi 3.5, 4.0, and 4.1
VMware ESX 3.5, 4.0, and 4.1

Multiple VMware products 'Mount.vmhgfs' Mutiple Security Vulnerabilities

An attacker requires local interactive access to a guest operating system in order to exploit this issue.

Multiple VMware products 'Mount.vmhgfs' Mutiple Security Vulnerabilities

Solution:
The vendor has released an advisory and patches. Please see the references for more information.

Multiple VMware products 'Mount.vmhgfs' Mutiple Security Vulnerabilities

References:

• VMware Homepage (VMware)
  
• VMSA-2011-0009 (VMware)
  
• VMware Tools Multiple Vulnerabilities (VSR)