VMware Directory Traversal and Privilege Escalation Vulnerabilities

Description

Two vulnerabilities have been identified in various VMware products, which could be exploited by attackers or malicious users to disclose sensitive information or gain elevated privileges. The first issue is caused due to an improper setting of the exception code on page faults on guest operating systems, which could allow malicious users to gain elevated privileges on a guest OS. The second vulnerability is caused by an unspecified input validation error, which could allow attackers with access to the network on which the host resides to download any file from the host system via directory traversal attacks

The following programs are vulnerable.

  • VMware Workstation version 6.5.2 and prior
  • VMware Player version 2.5.2 and prior
  • VMware ACE version 2.5.2 and prior
  • VMware Server version 2.0.1 and prior
  • VMware Server version 1.0.9 and prior
  • VMware Fusion version 2.0.5 and prior
  • VMware ESXi version 4.0
  • VMware ESXi version 3.5
  • VMware ESX version 4.0
  • VMware ESX version 3.5
  • VMware ESX version 3.0.3
  • VMware ESX version 2.5.5
    • ShareShare on FacebookTweet about this on TwitterShare on Google+

      Impact
      By exploiting directory traversal vulnerabilities, attackers step out of the root directory and access files in other directories. As a result, attackers might view restricted files or execute commands, leading to a full compromise of the Web server.

      Recommendation
      Apply patches or upgrade to fixed versions.

      References
      CVE-2009-3733
      VMware hosted products and ESX patches resolve two security issues