133 lines
No EOL
5.3 KiB
Text
133 lines
No EOL
5.3 KiB
Text
VMware Tools update OS Command Injection
|
||
========================================
|
||
|
||
1. Advisory Information
|
||
Advisory ID: BONSAI-2010-0110
|
||
Date published: Thu Dec 9, 2010
|
||
Vendors contacted: VMware
|
||
Release mode: Coordinated release
|
||
|
||
2. Vulnerability Information
|
||
Class: Injection
|
||
Remotely Exploitable: Yes
|
||
Locally Exploitable: Yes
|
||
CVE Name: CVE-2010-4297
|
||
|
||
3. Software Description
|
||
VMware Tools is a suite of utilities that enhances the performance of
|
||
the virtual machine's guest operating system and improves management of
|
||
the virtual machine. Without VMware Tools installed in your guest
|
||
operating system, guest performance lacks important functionality.
|
||
Installing VMware Tools eliminates or improves the following issues:
|
||
|
||
* low video resolution
|
||
* inadequate color depth
|
||
* incorrect display of network speed
|
||
* restricted movement of the mouse
|
||
* inability to copy and paste and drag-and-drop files
|
||
* missing sound
|
||
|
||
VMware Tools includes these components:
|
||
|
||
* VMware Tools service
|
||
* VMware device drivers
|
||
* VMware user process
|
||
* VMware Tools control panel
|
||
|
||
VMware Tools is provided in the following formats:
|
||
|
||
* ISOs (contain .tar and .rpm files) – packaged with the product and
|
||
are installed in a number of ways, depending upon the VMware product and
|
||
the guest operating system installed in the virtual machine. VMware
|
||
Tools provides a different ISO file for each type of supported guest
|
||
operating system: Windows, Linux, NetWare, Solaris, and FreeBSD.
|
||
* Operating System Specific Packages (OSPs) – downloaded and
|
||
installed from the command line. VMware Tools is available as separate
|
||
downloadable, light-weight packages that are specific to each supported
|
||
Linux operating system and VMware product. OSPs are an alternative to
|
||
the existing mechanism for installing VMware Tools and only support
|
||
Linux systems running on ESX.
|
||
|
||
4. Vulnerability Description
|
||
Injection flaws, such as SQL, OS, and LDAP injection, occur when
|
||
untrusted data is sent to an interpreter as part of a command or query.
|
||
The attacker’s hostile data can trick the interpreter into executing
|
||
unintended commands or accessing unauthorized data.
|
||
|
||
5. Vulnerable packages
|
||
Column 4 of the following table lists the action required to remediate
|
||
the vulnerability in each release, if a solution is available:
|
||
VMWare Product Product Version Running On Replace with / Apply Patch
|
||
VirtualCenter any Windows not affected
|
||
Workstation 7.X any 7.1.2 Build 301548 or later
|
||
Workstation 6.5.X any 6.5.5 Build 328052 or later
|
||
Player 3.1.X any 3.1.2 Build 301548 or later
|
||
Player 2.5.X any 2.5.5 Build 328052 or later
|
||
AMS any any not affected
|
||
Server 2.0.2 any affected, no patch planned
|
||
Fusion 3.1.X Mac OSX 3.1.2 Build 332101
|
||
Fusion 2.X Mac OSX 2.0.8 Build 328035
|
||
ESXi 4.1 ESXi ESXi410-201010402-BG
|
||
ESXi 4.0 ESXi ESXi400-201009402-BG
|
||
ESXi 3.5 ESXi ESXe350-201008402-T-BG **
|
||
ESX 4.1 ESX ESX410-201010405-BG
|
||
ESX 4.0 ESX ESX400-201009401-SG
|
||
ESX 3.5 ESX ESX350-201008409-BG **
|
||
ESX 3.0.3 ESX not affected
|
||
|
||
* hosted products are VMware Workstation, Player, ACE, Fusion.
|
||
** Non Windows-based guest systems on ESXi 3.5 and ESX 3.5 only:
|
||
- Install the relevant ESX patch.
|
||
- Manually upgrade tools in the virtual machine (virtual machine
|
||
users will not be prompted to upgrade tools). Note the VI Client may
|
||
not show that the VMware tools is out of date in th summary tab.
|
||
Full VMWare advisory could be found at:
|
||
http://www.vmware.com/security/advisories/VMSA-2010-0018.html
|
||
|
||
6. Non-vulnerable packages
|
||
See above table.
|
||
|
||
7. Credits
|
||
This vulnerability was discovered by Nahuel Grisolia ( nahuel -at-
|
||
bonsai-sec.com ).
|
||
|
||
8. Technical Description
|
||
8.1. OS Command Injection – PoC Example
|
||
CVSSv2 Score: 8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
|
||
VMware Server Infrastructure Web Access is prone to remote command
|
||
execution vulnerability because the software fails to adequately
|
||
sanitize user-supplied input.
|
||
When Updating the VMTools on a certain Guest Virtual Machine, a command
|
||
injection attack can be executed if specially crafted parameters are sent.
|
||
Successful attacks can compromise the affected Guest Virtual Machine
|
||
with root privileges.
|
||
The following proof of concept is given. It was exploited in a GNU/Linux
|
||
Guest with VMware Tools installed but not fully updated:
|
||
POST /ui/sb HTTP/1.1
|
||
[…]
|
||
Cookie: JSESSIONID=F78CCA7DD3CF4E2E82587B236660C9ED; user_name=vmuser;
|
||
l=http%3A%2F%2Flocalhost%3A80%2Fsdk
|
||
[…]
|
||
[{i:"378",exec:"/cmd/vm",args:["UpgradeTools_Task",{_i:"VirtualMachine|960"},";
|
||
INJECTED COMMAND HERE ;"]}]
|
||
|
||
|
||
9. Report Timeline
|
||
• 2010-04-24 / Vulnerabilities were identified
|
||
• 2010-04-29 – 2010-12-02 / Multiple Contacts with Vendor
|
||
• 2010-12-09 / Vulnerability is Disclosed – PoC attached
|
||
|
||
10. About Bonsai
|
||
Bonsai is a company involved in providing professional computer
|
||
information security services. Currently a sound growth company, since
|
||
its foundation in early 2009 in Buenos Aires, Argentina, we are fully
|
||
committed to quality service and focused on our customers’ real needs.
|
||
|
||
11. Disclaimer
|
||
The contents of this advisory are copyright (c) 2010 Bonsai Information
|
||
Security, and may be distributed freely provided that no fee is charged
|
||
for this distribution and proper credit is given.
|
||
|
||
12. Research
|
||
http://www.bonsai-sec.com/en/research/vulnerability.php
|
||
http://www.bonsai-sec.com/en/research/vulnerabilities/vmware-tools-os-command-injection-0110.php |