The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
VMware Workstation Shared Folders Directory Traversal Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.vmware.com/products/ws/> VMware Workstation is "a software
virtualization system which allows multiple virtual computers to run on a
single system".
Remote exploitation of a design error in the "Shared Folders" feature of
VMware Inc.'s VMware Workstation could allow an attacker to write
arbitrary content from a guest system to arbitrary locations on the host
system.
DETAILS
Vulnerable Systems:
* VMware Workstation version 5.5.3 build 34685 on a Windows XPSP2 host.
* (Other versions may also be affected.)
The "Shared Folders" feature of VMware Workstation allows folders on the
physical "host" system to be shared with virtual "guest" systems. Due to a
flaw in the code which validates that the filename is safe, an attacker or
malicious code within the guest system can read or write files on the host
system in the context of the user running Workstation.
Exploitation allows an attacker to read or write arbitrary files on the
host system.
In order to exploit this vulnerability, the VMware system must have at
least one folder shared. Although the "Shared Folders" feature is enabled
by default, no folders are shared by default. If the 'Read Only' option
for a shared folder is set, the attacker will only be able to read files
from the host.
The documentation states that VMware Tools must be installed in order to
use the "Shared Folders" feature. While this is true of normal use of the
feature, VMware Tools is not required to exploit this vulnerability. The
vulnerable functionality is supplied by the "Backdoor I/O Port" interface.
Some details of the interface protocol are publicly available. These
details provide a starting point which allow an attacker to reverse
engineer enough of the protocol to implement their own tool for performing
these operations.
Workarounds:
Disabling the "Shared Folders" feature in VMware will prevent exposure to
this vulnerability.
Vendor Status:
VMware Inc. has addressed this vulnerability by releasing new versions of
their software. More information is available in the release notes
provided by VMware Inc.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1744>
CVE-2007-1744
Disclosure Timeline:
* 03/20/2007 - Initial vendor notification
* 03/20/2007 - Initial vendor response
* 04/27/2007 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=521>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=521
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
