GLSA-201209-25 : VMware Player, Server, Workstation: Multiple vulnerabilities

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote Gentoo host is missing one or more security-related
patches.

Description :

The remote host is affected by the vulnerability described in GLSA-201209-25
(VMware Player, Server, Workstation: Multiple vulnerabilities)

Multiple vulnerabilities have been discovered in VMware Player, Server,
and Workstation. Please review the CVE identifiers referenced below for
details.

Impact :

Local users may be able to gain escalated privileges, cause a Denial of
Service, or gain sensitive information.
A remote attacker could entice a user to open a specially crafted file,
possibly resulting in the remote execution of arbitrary code, or a Denial
of Service. Remote attackers also may be able to spoof DNS traffic, read
arbitrary files, or inject arbitrary web script to the VMware Server
Console.
Furthermore, guest OS users may be able to execute arbitrary code on the
host OS, gain escalated privileges on the guest OS, or cause a Denial of
Service (crash the host OS).

Workaround :

There is no known workaround at this time.

See also :

http://www.gentoo.org/security/en/glsa/glsa-201209-25.xml

Solution :

Gentoo discontinued support for VMware Player. We recommend that users
unmerge VMware Player:
# emerge --unmerge 'app-emulation/vmware-player'
NOTE: Users could upgrade to
&ldquo
>=app-emulation/vmware-player-3.1.5&rdquo
, however these packages are
not currently stable.
Gentoo discontinued support for VMware Workstation. We recommend that
users unmerge VMware Workstation:
# emerge --unmerge 'app-emulation/vmware-workstation'
NOTE: Users could upgrade to
&ldquo
>=app-emulation/vmware-workstation-7.1.5&rdquo
, however these packages
are not currently stable.
Gentoo discontinued support for VMware Server. We recommend that users
unmerge VMware Server:
# emerge --unmerge 'app-emulation/vmware-server'

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.3
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true