VMSA-2010-0018 : VMware hosted products and ESX patches resolve multiple security issues

This script is Copyright (C) 2010-2014 Tenable Network Security, Inc.


Synopsis :

The remote VMware ESX host is missing a security-related patch.

Description :

a. VMware Workstation, Player and Fusion vmware-mount race condition

The way temporary files are handled by the mounting process could
result in a race condition. This issue could allow a local user on
the host to elevate their privileges.

VMware Workstation and Player running on Microsoft Windows are not
affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4295 to this issue.

VMware would like to thank Dan Rosenberg for reporting this issue.

b. VMware Workstation, Player and Fusion vmware-mount privilege
escalation

vmware-mount which is a suid binary has a flaw in the way libraries
are loaded. This issue could allow local users on the host to
execute arbitrary shared object files with root privileges.

VMware Workstation and Player running on Microsoft Windows are not
affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4296 to this issue.

VMware would like to thank Martin Carpenter for reporting this
issue.

c. OS Command Injection in VMware Tools update

A vulnerability in the input validation of VMware Tools update
allows for injection of commands. The issue could allow a user
on the host to execute commands on the guest operating system
with root privileges.

The issue can only be exploited if VMware Tools is not fully
up-to-date. Windows-based virtual machines are not affected.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4297 to this issue.

VMware would like to thank Nahuel Grisolia of Bonsai Information
Security, http://www.bonsai-sec.com, for reporting this issue.

d. VMware VMnc Codec frame decompression remote code execution

The VMware movie decoder contains the VMnc media codec that is
required to play back movies recorded with VMware Workstation,
VMware Player and VMware ACE, in any compatible media player. The
movie decoder is installed as part of VMware Workstation, VMware
Player and VMware ACE, or can be downloaded as a stand alone
package.

A function in the decoder frame decompression routine implicitly
trusts a size value. An attacker can utilize this to miscalculate
a destination pointer, leading to the corruption of a heap buffer,
and could allow for execution of arbitrary code with the privileges
of the user running an application utilizing the vulnerable codec.

For an attack to be successful the user must be tricked into
visiting a malicious web page or opening a malicious video file on
a system that has the vulnerable version of the VMnc codec installed.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2010-4294 to this issue.

VMware would like to thank Aaron Portnoy and Logan Brown of
TippingPoint DVLabs for reporting this issue.

See also :

http://lists.vmware.com/pipermail/security-announce/2010/000112.html

Solution :

Apply the missing patch.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: VMware ESX Local Security Checks

Nessus Plugin ID: 50985 ()

Bugtraq ID: 45167
45168

CVE ID: CVE-2010-4294
CVE-2010-4295
CVE-2010-4296
CVE-2010-4297