From ${URL} : Description A vulnerability has been reported in VMware Workstation and VMware Player, which can be exploited by malicious, local users to gain escalated privileges. The vulnerability is caused due to an unspecified error within vmware-mount and can be exploited to escalate privileges to root on the host OS. NOTE: The vulnerability affects only installations running on Debian-based Linux platforms. The vulnerability is reported in the following products and versions: * VMware Workstation versions 8.x and 9.x * VMware Player versions 4.x and 5.x Solution: Apply updates or workarounds. Further details available to Secunia VIM customers Provided and/or discovered by: The vendor credits Tavis Ormandy, Google Security Team. Original Advisory: VMware (VMSA-2013-0010): http://www.vmware.com/security/advisories/VMSA-2013-0010.html @maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Well, some good news. vmware-player is unaffected, since the upstream advisory says that the fix is to remove the SUID bit from vmware-mount (which we install into /opt/vmware/bin/vmware-mount), and we do not set the SUID bit. @vmware team: could you please check whether this also applies to vmware-workstation? If that is also unaffected, I think we're in good shape. I'm not 100% certain, though, since a) the upstream advisory says that removing SUID is a sufficient workaround for both player and workstation in addition to providing a fixed file for workstation, and b) the upstream release specifically mentions debian/ubuntu, so perhaps this is a packaging issue.
CVE-2013-1662 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1662): vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsb_release binary in a directory in the PATH, related to use of the popen library function.
From a reading of the CVE, it looks like this is almost certainly a packaging issue with Debian/Ubuntu. @vmware team: please verify this, then we can close this as INVALID.
Agree that this appears to be a packaging issue on other distros. Closing INVALID.
