Skip to main content

VMware security advisory update: Critical memory corruption vulnerability

DoD guys and all the other folks who are building expertise around the security which they have gained while building a secured VMware environment by design, are also being exposed to the ones that can play potential havoc in your environments, should you not take security into account when designing and operating your virtual environments.

Ask yourself the following:

  • Do you know that such malicious attacks are not taking place in your environment?
  • Do you know if there is some sort of control in your environments?
  • How many of you have successfully deployed a CCP that makes your ESX complaint or atleast anywhere close to being SOX/PCI DSS 1.x standards? You must be able to control, authorize and demonstrate on your sense of control on these environments, can you do it?
  • Are you doing any sort of assessments in your environments, especially Virtual Infrastructures be it Oracle VM, VMware ESX, Citrix Xen, Xen or whatever?
  • Are some or any of your virtual platforms registered within your centralized directory, any LDAP v3 variants such as ADS etc?
Don't ignore the issues as they will come haunting you in some form or the other. Anyways, here's the advisory.

3. Problem Description

a. Critical Memory corruption vulnerability

A memory corruption condition may occur in the virtual machine
hardware. A malicious request sent from the guest operating
system to the virtual hardware may cause the virtual hardware to
write to uncontrolled physical memory.

VMware would like to thank Andrew Honig of the Department of
Defense for reporting this issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2008-4917 to this issue.

The following table lists what action remediates the vulnerability
(column 4) if a solution is available.

VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected

Workstation 6.5.x any not affected
Workstation 6.0.x any 6.5.0 build 118166 or later
Workstation 5.x any 5.5.9 build 126128 or later

Player 2.5.x any not affected
Player 2.0.x any 2.5.0 build 118166 or later
Player 1.x any 1.0.9 build 126128 or later

ACE 2.5.x Windows not affected
ACE 2.0.x Windows 2.5.0 build 118166 or later
ACE 1.x Windows 1.0.8 build 125922 or later

Server 2.x any not affected
Server 1.x any 1.0.8 build 126538 or later

Fusion 2.x Mac OS/X not affected
Fusion 1.x Mac OS/X upgrade to Fusion 2.0 or later

ESXi 3.5 ESXi ESXe350-200811401-O-SG

ESX 3.5 ESX ESX350-200811401-SG
ESX 3.0.3 ESX ESX303-200811401-BG
ESX 3.0.2 ESX ESX-1006980
ESX 2.5.5 ESX not affected



VMware Security Lists
Labels:

Comments

Post a Comment

Popular posts from this blog

Security: VMware Workstation 6 vulnerability

vulnerable software: VMware Workstation 6.0 for Windows, possible some other VMware products as well type of vulnerability: DoS, potential privilege escalation I found a vulnerability in VMware Workstation 6.0 which allows an unprivileged user in the host OS to crash the system and potentially run arbitrary code with kernel privileges. The issue is in the vmstor-60 driver, which is supposed to mount VMware images within the host OS. When sending the IOCTL code FsSetVoleInformation with subcode FsSetFileInformation with a large buffer and underreporting its size to at max 1024 bytes, it will underrun and potentially execute arbitrary code. Security focus
Post a Comment
Read more

Virtualization: GlassHouse hopes to cash in with its IPO!

GlassHouse Technologies Inc. on Tuesday registered to raise as much as $100 million in an initial public offering that, despite the company's financial losses, could prove a hit with investors drawn to its focus on "virtualization" technology. The Framingham, Mass., company offers consulting services for companies that use virtualization software to improve the performance of corporate servers and cut costs in their data centers. GlassHouse also provides Internet-based data storage. "Software-as-a-service," or SaaS, companies and vendors of virtualization products have proved popular among investors in recent years as corporate customers seek alternatives to conventional packaged software. GlassHouse, with roots in both sectors, will test the strength of that interest, said Peter Falvey, managing director with Boston investment bank Revolution Partners. "It will be a bit of a bell weather," he says. "It's not as though it's the 15th SaaS m...
Post a Comment
Read more