101 lines
No EOL
2.9 KiB
Text
101 lines
No EOL
2.9 KiB
Text
[DSECRG-09-053] VMware Remote Console - format string vulnerability
|
|
http://www.dsecrg.com/pages/vul/show.php?id=153
|
|
|
|
VMrc vulnerable to format string attacks. Exploitation of this issue may lead to arbitrary code execution on the system where VMrc is installed.
|
|
|
|
Digital Security Research Group [DSecRG] Advisory DSECRG-09-053
|
|
|
|
|
|
Application: VMware Remoute Console
|
|
Version: e.x.p build-158248
|
|
Vendor URL: http://vmware.com
|
|
Bugs: Format String Vulnerabilitys
|
|
Exploits: YES (PoC)
|
|
Reported: 07.08.2009
|
|
Vendor response: 13.08.2009
|
|
Date of Public Advisory: 09.04.2010
|
|
CVE: CVE-2009-3732
|
|
VSA: VMSA-2010-0007
|
|
Authors: Alexey Sintsov of
|
|
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
|
|
|
|
|
|
|
|
Description
|
|
********
|
|
|
|
VMware Remote Console Plug-in can be installed from WEB
|
|
interface of VMware vSphere. This software contains of ActiveX
|
|
objects and executable files for remote console of guest OS.
|
|
VMrc vulnerable to format string attacks. Exploitation of this issue
|
|
may lead to arbitrary code execution on the system where VMrc is installed.
|
|
|
|
|
|
Details
|
|
*******
|
|
|
|
Attacker can make shortcut with special parameters for
|
|
vmware-vmrc.exe and bad MOID or HOST parameter. If a user try to use
|
|
this shortcut to connect to vSphere server he will see next message
|
|
box:
|
|
|
|
"Error opening the remote virtual
|
|
machine HOST\MOID: The object has already been deleted
|
|
or has not been completely created."
|
|
|
|
If user name or password will be incorrect the user also gets error
|
|
message box.
|
|
|
|
Parameters HOST and MOID are addicted to format injection.
|
|
|
|
Also this vuln. can be exploited remotely by special crafted html page.
|
|
|
|
ActiveX element: clsid:B94C2238-346E-4C5E-9B36-8CC627F35574
|
|
|
|
Attacker can rewrite stack data and may be it's possible to code
|
|
execution.
|
|
|
|
|
|
|
|
Example(shortcut):
|
|
*****************
|
|
|
|
C:\Program Files\Common Files\VMware\VMware Remote Console Plug-in>vmware-vmrc.exe -u vmware_user -h HOST -M AAAA:%x.%x.%x.%x.:BBBB
|
|
|
|
VMDlg::ShowDialog: Error opening the remote virtual machine
|
|
HOST\AAAA:3455600.78138a94.100012b2.28e27b0.:BBBB:
|
|
|
|
Example(ActiveX):
|
|
****************
|
|
|
|
objectVMRC.connect ("host" ,"username" ,"password",
|
|
"%x:%x:%x:%x:%x:%x:%x:%x:%x" ,"X" ,2);
|
|
|
|
|
|
Fix Information
|
|
***************
|
|
VMware has released the following patch for
|
|
ESX 4.0: ESX400-200911223-UG
|
|
|
|
Also this issue solved in vCenter 4.0 Update 1
|
|
|
|
References
|
|
**********
|
|
|
|
http://dsecrg.com/pages/vul/show.php?id=153
|
|
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
|
|
|
|
About
|
|
*****
|
|
|
|
Digital Security is leading IT security company in Russia,
|
|
providing information security consulting, audit and penetration
|
|
testing services, risk analysis and ISMS-related services and
|
|
certification for ISO/IEC 27001:2005 and PCI DSS standards.
|
|
Digital Security Research Group focuses on web application and database
|
|
security problems with vulnerability reports, advisories and whitepapers
|
|
posted regularly on our website.
|
|
|
|
|
|
Contact: research [at] dsecrg [dot] com
|
|
http://www.dsecrg.com |