VMSA-2008-0014:Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX, VMware VCB address information disclosure, privilege escalation and other security issues.
23361
27 August 2008
27 August 2008
CLOSED
HIGH
CVE-2008-2101,CVE-2007-5269,CVE-2008-1447
VMSA-2008-0014.3
Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX, VMware VCB address information disclosure, privilege escalation and other security issues.
VMware Security Advisory
CVE-2008-3691 CVE-2008-3692 CVE-2008-3693
CVE-2008-3694 CVE-2008-3695 CVE-2007-5438
CVE-2008-3696 CVE-2008-3697 CVE-2008-3698
CVE-2008-1806 CVE-2008-1807 CVE-2008-1808
CVE-2007-5503
1. Summary
Updates to VMware Workstation, VMware Player, VMware ACE, VMware
Server, VMware ESX, VMware VCB address information disclosure,
privilege escalation and other security issues.
2. Relevant releases
VMware Workstation 6.0.4 and earlier,
VMware Workstation 5.5.7 and earlier,
VMware Player 2.0.4 and earlier,
VMware Player 1.0.7 and earlier,
VMware ACE 2.0.4 and earlier,
VMware ACE 1.0.6 and earlier,
VMware Server 1.0.6 and earlier,
VMware ESXi 3.5 without patch ESXe350-200808501-I-SG
VMware ESX 3.5 without patches ESX350-200808401-BG,
ESX350-200808409-SG.
VMware ESX 3.0.3 without patches ESX303-200808404-SG,
ESX303-200808403-SG
ESX303-200808406-SG.
VMware ESX 3.0.2 without patches ESX-1005109, ESX-1005113,
ESX-1005114.
VMware ESX 3.0.1 without patches ESX-1005108, ESX-1005112,
ESX-1005111, ESX-1004823,
ESX-1005117.
VMware ESX 2.5.5 before Upgrade Patch 10
VMware ESX 2.5.4 before Upgrade Patch 20
VMware VCB 1.1
NOTE: Hosted products VMware Workstation 5.x, VMware Player 1.x,
and VMware ACE 1.x will reach end of general support
2008-11-09. Customers should plan to upgrade to the latest
version of their respective products.
Extended support (Security and Bug fixes) for ESX 3.0.2 ends
on 10/29/2008 and Extended support for ESX 3.0.2 Update 1
ends on 8/8/2009. Users should plan to upgrade to ESX 3.0.3
and preferably to the newest release available.
Extended Support (Security and Bug fixes) for ESX 3.0.1 has
ended on 2008-07-31. The 3.0.1 patches are released in
August because there was no patch release in July.
3. Problem Description
I Security Issues
a. Setting ActiveX killbit
Starting from this release, VMware has set the killbit on its
ActiveX controls. Setting the killbit ensures that ActiveX
controls cannot run in Internet Explorer (IE), and avoids
Microsoft KB article 240797 and the related references on this
topic.
Security vulnerabilities have been reported for ActiveX controls
provided by VMware when run in IE. Under specific circumstances,
exploitation of these ActiveX controls might result in denial-of-
service or can allow running of arbitrary code when the user
browses a malicious Web site or opens a malicious file in IE
browser. An attempt to run unsafe ActiveX controls in IE might
result in pop-up windows warning the user.
Note: IE can be configured to run unsafe ActiveX controls without
prompting. VMware recommends that you retain the default
settings in IE, which prompts when unsafe actions are
requested.
Earlier, VMware had issued knowledge base articles, KB 5965318 and
KB 9078920 on security issues with ActiveX controls. To avoid
malicious scripts that exploit ActiveX controls, do not enable
unsafe ActiveX objects in your browser settings. As a best
practice, do not browse untrusted Web sites as an administrator
and do not click OK or Yes if prompted by IE to allow certain
actions.
VMware would like to thank Julien Bachmann, Shennan Wang, Shinnai,
and Michal Bucko for reporting these issues to us.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the names CVE-2008-3691, CVE-2008-3692,
CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, CVE-2007-5438, and
CVE-2008-3696 to the security issues with VMware ActiveX controls.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
b. VMware ISAPI Extension Denial of Service
The Internet Server Application Programming Interface (ISAPI) is
an API that extends the functionality of Internet Information
Server (IIS). VMware uses ISAPI extensions in its Server product.
One of the ISAPI extensions provided by VMware is vulnerable to a
remote denial of service. By sending a malformed request, IIS
might shut down. IIS 6.0 restarts automatically. However, IIS 5.0
does not restart automatically when its Startup Type is set to Manual.
VMware would like to thank the Juniper Networks J-Security
Security Research Team for reporting this issue to us.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2008-3697 to this issue.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
c. OpenProcess Local Privilege Escalation on Host System
This release fixes a privilege escalation vulnerability in host
systems. Exploitation of this vulnerability allows users to run
arbitrary code on the host system with elevated privileges.
VMware would like to thank Sun Bing from McAfee, Inc. for
reporting this issue to us.
The Common Vulnerabilities and Exposures Project (cve.mitre.org)
has assigned the name CVE-2008-3698 to this issue.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
d. Update to Freetype
FreeType 2.3.6 resolves an integer overflow vulnerability and other
vulnerabilities that can allow malicious users to run arbitrary code
or might cause a denial-of-service after reading a maliciously
crafted file. This release updates FreeType to 2.3.7.
The Common Vulnerabilities and Exposures Project (cve.mitre.com)
has assigned the names CVE-2008-1806, CVE-2008-1807, and
CVE-2008-1808 to the issues resolved in Freetype 2.3.6.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
e. Update to Cairo
Cairo 1.4.12 resolves an integer overflow vulnerability that can
allow malicious users to run arbitrary code or might cause a
denial-of-service after reading a maliciously crafted PNG file.
This release updates Cairo to 1.4.14.
The Common Vulnerabilities and Exposures (cve.mitre.com) has
assigned the name CVE-2007-5503 to this issue.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
f. VMware Consolidated Backup (VCB) command-line utilities may expose sensitive information
VMware Consolidated Backup command-line utilities accept the user
password through the -p command-line option. Users logged into the
ESX service console or into the system that runs VCB could gain
access to the username and password used by VCB command-line
utilities
when such commands are running.
The ESX patch and the new version of VCB resolve this issue by
providing an alternative way of passing the password used by VCB
command-line utilities.
VCB in ESX
----------
The following options are recommended for passing the password:
1. The password is specified in /etc/backuptools.conf
(PASSWORD=xxxxx), and -p is not used in the command line.
/etc/backuptools.conf file permissions are read/write only
for root.
2. No password is specified in /etc/backuptools.conf and the
-p option is not used in the command line. The user will be
prompted to enter a password.
ESX is not affected unless you use VCB.
Stand-alone VCB
---------------
The following options are recommended for passing the password:
1. The password is specified in config.js (PASSWORD=xxxxx), and -p
is not used in the command line. The file permissions on config.js
are read/write only for the administrator. The config.js file is
located in folder "config" of the VCB installation folder. For
example,
C:\Program Files\Vmware\Vmware Consolidated Backup Framework\config.
2. The password is specified in the registry, and is not specified in
config.js, and -p is not used in the command line. Access to the
registry key holding the password is allowed only to the
administrator.
The location of the registry key is:
On Windows x86: HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\
VMware Consolidated Backup\Password
On Windows x64: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
VMware, Inc.\VMware Consolidated Backup\Password
3. The password is not specified in the registry, and is not
specified in
config.js, and -p is not used in the command line. The user will be
prompted to enter a password.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-2101 to this issue.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
* hosted products are VMware Workstation, Player, ACE, Server, Fusion
** VCB 1.5 already has the alternative ways of supplying the user password
g. Third Party Library libpng Updated to 1.2.29
Several flaws were discovered in the way third party library
libpng handled various PNG image chunks. An attacker could
create a carefully crafted PNG image file in such a way that
it causes an application linked with libpng to crash when the
file is manipulated.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2007-5269 to this issue.
NOTE: There are multiple patches required to remediate the issue.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
* hosted products are VMware Workstation, Player, ACE, Server, Fusion
II ESX Service Console rpm updates
a. update to bind
This update upgrades the service console rpms for bind-utils and
bind-lib to version 9.2.4-22.el3.
Version 9.2.4.-22.el3 addresses the recently discovered
vulnerability in the BIND software used for Domain Name
resolution (DNS). VMware doesn't install all the BIND packages
on ESX Server and is not vulnerable by default to the reported
vulnerability. Of the BIND packages, VMware only ships bind-util
and bind-lib in the service console and these components by
themselves cannot be used to setup a DNS server. Bind-lib and
bind-util are used in client DNS applications like nsupdate,
nslookup, etc.
VMware explicitly discourages installing applications like BIND
on the service console. In case the customer has installed BIND,
and the DNS server is configured to support recursive queries,
their ESX Server system is affected and they should replace BIND
with a patched version.
Note: ESX Server will use the DNS server on the network it is
on, so it is important to patch that DNS server.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-1447 to this issue.
VMware Product
Product Version
Running on
Replace with/ Apply Patch
* hosted products are VMware Workstation, Player, ACE, Server, Fusion
4. Solution
Please review the patch/release notes for your product and version
and verify the md5sum of your downloaded file.
VMware Workstation 6.0.5
------------------------
http://www.vmware.com/download/ws/
Release notes:
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
Windows binary
md5sum: 46b4c54f0493f59f52ac6c2965296859
RPM Installation file for 32-bit Linux
md5sum: 49ebfbd05d146ecc43262622ab746f03
tar Installation file for 32-bit Linux
md5sum: 14ac93bffeee72528629d4caecc5ef37
RPM Installation file for 64-bit Linux
md5sum: 0a856f1a1a31ba3c4b08bcf85d97ccf6
tar Installation file for 64-bit Linux
md5sum: 3b459254069d663e9873a661bc97cf6c
VMware Workstation 5.5.8
------------------------
http://www.vmware.com/download/ws/ws5.html
Release notes:
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
Windows binary:
md5sum: 745c3250e5254eaf6e65fcfc4172070f
Compressed Tar archive for 32-bit Linux
md5sum: 65a454749d15d4863401619d7ff5566e
Linux RPM version for 32-bit Linux
md5sum: d80adc73b1500bdb0cb24d1b0733bcff
VMware Player 2.0.5 and 1.0.8
-----------------------------
http://www.vmware.com/download/player/
Release notes Player 1.x:
http://www.vmware.com/support/player/doc/releasenotes_player.html
Release notes Player 2.0
http://www.vmware.com/support/player2/doc/releasenotes_player2.html
2.0.5 Windows binary
md5sum: 60265438047259b23ff82fdfe737f969
VMware Player 2.0.5 for Linux (.rpm)
md5sum: 3bc81e203e947e6ca5b55b3f33443d34
VMware Player 2.0.5 for Linux (.tar)
md5sum: f499603d790edc5aa355e45b9c5eae01
VMware Player 2.0.5 - 64-bit (.rpm)
md5sum: 85bc2f11d06c362feeff1a64ee5a6834
VMware Player 2.0.5 - 64-bit (.tar)
md5sum: b74460bb961e88817884c7e2c0f30215
1.0.8 Windows binary
md5sum: e5f927304925297a7d869f74b7b9b053
Player 1.0.8 for Linux (.rpm)
md5sum: a13fdb8d72b661cefd24e7dcf6e2a990
Player 1.0.8 for Linux (.tar)
md5sum: 99fbe861253eec5308d8c47938e8ad1e
VMware ACE 2.0.5
----------------
http://www.vmware.com/download/ace/
Release notes 2.0:
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
ACE Manager Server Virtual Appliance
Virtual Appliance for the ACE Management Server
md5sum: 41e7349f3b6568dffa23055bb629208d
ACE for Window 32-bit and 64-bit
Main installation file for Windows 32-bit and 64-bit host (ACE Option
Page key required for enabling ACE authoring)
md5sum:46b4c54f0493f59f52ac6c2965296859
ACE Management Server for Windows
ACE Management Server installation file for Windows
md5sum:33a015c4b236329bcb7e12c82271c417
ACE Management Server for Red Hat Enterprise Linux 4
ACE Management Server installation file for Red Hat Enterprise Linux 4
md5sum:dc3bd89fd2285f41ed42f8b28cd5535f
ACE Management Server for SUSE Enterprise Linux 9
ACE Management Server installation file for SUSE Enterprise Linux 9
md5sum:2add6a4fc97e1400fb2f94274ce0dce0
VMware ACE 1.0.7
----------------
http://www.vmware.com/download/ace/
Release notes:
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
md5sum: 42d806cddb8e9f905722aeac19740f33
VMware Server 1.0.7
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server/doc/releasenotes_server.html
VMware Server for Windows 32-bit and 64-bit
md5sum: 2e2ee5ebe08ae48eac5e661cad01acf6
VMware Server Windows client package
md5sum: ce7d906a5a8de37cbc20db4332de1adb
VMware Server for Linux
md5sum: 04f201122b16222cd58fc81ca814ff8c
VMware Server for Linux rpm
md5sum: 6bae706df040c35851823bc087597d8d
Management Interface
md5sum: e67489bd2f23bcd4a323d19df4e903e8
VMware Server Linux client package
md5sum: 99f1107302111ffd3f766194a33d492b
ESXi
----
ESXi 3.5 patch ESXe350-200808501-O-SG
http://download3.vmware.com/software/esx/ESXe350-200808501-O-SG.zip
md5sum: bee3e2da8054e46686e446e8dc49040e
http://kb.vmware.com/kb/1005818
NOTE: ESXe350-200808501-O-SG contains the following patch bundles:
ESXe350-200808501-I-SG, ESXe350-200808502-T-BG, and
ESXe350-200808203-C-UG
ESX
---
ESX 3.5 patch ESX350-200808203-UG (VCB)
http://download3.vmware.com/software/esx/ESX350-200808203-UG.zip
md5sum: a6b9ac38472ec3f29c979c84e730dfbf
http://kb.vmware.com/kb/1005896
ESX 3.5 patch ESX350-200808409-SG (bind)
http://download3.vmware.com/software/vi/ESX350-200808409-SG.zip
md5sum: fcf5da82089644f34a4967a411855a3d
http://kb.vmware.com/kb/1005812
ESX 3.5 patch ESX350-200808401-BG (libpng)
http://download3.vmware.com/software/esx/ESX350-200808401-BG.zip
md5sum: 270987dc2a17f8aaee703fb6501a72e5
http://kb.vmware.com/kb/1005807
ESX 3.0.3 patch ESX303-200808403-SG (libpng)
http://download3.vmware.com/software/vi/ESX303-200808403-SG.zip
md5sum: 5f1e75631e53c0e9e013acdbe657cfc7
http://kb.vmware.com/kb/1006034
ESX 3.0.3 patch ESX303-200808404-SG (libpng)
http://download3.vmware.com/software/vi/ESX303-200808404-SG.zip
md5sum: 65468a5b6ba105cfde1dd444d77b2df4
http://kb.vmware.com/kb/1006035
ESX 3.0.3 patch ESX303-200808406-SG (bind)
http://download3.vmware.com/software/vi/ESX303-200808406-SG.zip
md5sum: a11273e8d430e5784071caff673995f4
http://kb.vmware.com/kb/1006357
ESX 3.0.2 patch ESX-1005109 (libpng)
http://download3.vmware.com/software/vi/ESX-1005109.tgz
md5sum: 456d74d94317f852024aed5d3852be09
http://kb.vmware.com/kb/1005109
ESX 3.0.2 patch ESX-1005113 (libpng)
http://download3.vmware.com/software/vi/ESX-1005113.tgz
md5sum: 5d604f2bfd90585b9c8679f5fc8c31b7
http://kb.vmware.com/kb/1005113
ESX 3.0.2 patch ESX-1005114 (libpng)
http://download3.vmware.com/software/vi/ESX-1005114.tgz
md5sum: 3b6d33b334f0020131580fdd8f9b5365
http://kb.vmware.com/kb/1005114
ESX 3.0.2 patch ESX-1004824 (VCB)
http://download3.vmware.com/software/vi/ESX-1004824.tgz
md5sum: c72b0132c9f5d7b4cb1b9e47748a9c5b
http://kb.vmware.com/kb/1004824
ESX 3.0.2 patch ESX-1006356 (bind)
http://download3.vmware.com/software/vi/ESX-1006356.tgz
md5sum: f0bc9d0b641954145df3986cdb1c2bab
http://kb.vmware.com/kb/1006356
ESX 3.0.1 patch ESX-1005111 (libpng)
http://download3.vmware.com/software/vi/ESX-1005111.tgz
md5sum: 60e1be9b41070b3531c06f9a0595e24c
http://kb.vmware.com/kb/1005111
ESX 3.0.1 patch ESX-1005112 (libpng)
http://download3.vmware.com/software/vi/ESX-1005112.tgz
md5sum: ad645cef0f9fa18bb648ba5a37074732
http://kb.vmware.com/kb/1005112
ESX 3.0.1 patch ESX-1005108 (libpng)
http://download3.vmware.com/software/vi/ESX-1005108.tgz
md5sum: aabc873d978f023c929ccd9a54588ea5
http://kb.vmware.com/kb/1005108
ESX 3.0.1 patch ESX-1004823 (VCB)
http://download3.vmware.com/software/vi/ESX-1004823.tgz
md5sum: 5ff2e8ce50c18afca76fb16c28415a59
http://kb.vmware.com/kb/1004823
ESX 3.0.1 patch ESX-1005117 (bind)
http://download3.vmware.com/software/vi/ESX-1005117.tgz
md5sum: 5271ecc6e36fb6f1fdf372e57891aa33
http://kb.vmware.com/kb/1005117
VMware ESX 2.5.5 Upgrade Patch 10
http://download3.vmware.com/software/esx/esx-2.5.5-119702-upgrade.tar.gz
md5sum: 2ee87cdd70b1ba84751e24c0bd8b4621
http://vmware.com/support/esx25/doc/esx-255-200810-patch.html
VMware ESX 2.5.4 Upgrade Patch 21
http://download3.vmware.com/software/esx/esx-2.5.4-119703-upgrade.tar.gz
md5sum: d791be525c604c852a03dd7df0eabf35
http://vmware.com/support/esx25/doc/esx-254-200810-patch.html
VCB
---
VMware Virtual Consolidated Backup 1.1 Update 1 build 118380
http://www.vmware.com/downloads/download.do?downloadGroup=VCB110U1
md5sum: 4dcff8d1236a77882fd0eee54eafffb2
Release Notes
http://www.vmware.com/support/vi3/doc/vcb11u1_rel_notes.html
5. References
CVE numbers
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2101
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5269
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3691
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3692
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3693
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3694
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3695
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5438
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3696
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3697
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3698
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1808
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5503
6. Change log
2008-08-29 VMSA-2008-0014
Initial security advisory after the release of ESX 3.0.x patches
on 2008-08-28.
2008-09-18 VMSA-2008-0014.1
Added updated information for libpng and bind after the release of
patches for ESXi 3.5 and ESX 3.5 on 2008-09-18.
2008-10-03 VMSA-2008-0014.2
Added updated information on secure ways of providing password in
VMware Consolidated Backup (VCB) after release of VCB 1.1 Update 1
on 2008-10-03.
2008-10-31 VMSA-2008-0014.3
Added updated information for freetype, bind, libpng after the
release of patches for ESX 2.5.4 and ESX 2.5.5 on 2008-10-30.
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
* security-announce at lists.vmware.com
* bugtraq at securityfocus.com
* full-disclosure at lists.grok.org.uk
E-mail: security at vmware.com
PGP key at: http://kb.vmware.com/kb/1055
VMware Security Center
http://www.vmware.com/security
VMware security response policy
http://www.vmware.com/support/policies/security_response.html
General support life cycle policy
http://www.vmware.com/support/policies/eos.html
VMware Infrastructure support life cycle policy
http://www.vmware.com/support/policies/eos_vi.html