| Summary: | VMware Multiple vulnerabilities (CVE-2007-5671,CVE-2008-{0967,2098,2100}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Robert Buchholz (RETIRED) <rbu> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | craig, jesse, kronenpj, micheleschi, reillyeon, s.hase, vmware+disabled |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.vmware.com/security/advisories/VMSA-2008-0008.html | ||
| Whiteboard: | B2 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Robert Buchholz (RETIRED)
2008-06-02 17:25:11 UTC
We need these fixed versions: Workstation 6.x Linux 6.0.4 build 93057 Player 2.x Linux 2.0.4 build 93057 All others (incl. stable) are not affected. The advisory VMSA-2008-0009 says: Workstation 6.x Linux not affected Player 2.x Linux not affected Oh damn, wait, that was just one of them, sorry! Also see http://bugs.gentoo.org/show_bug.cgi?id=224861 Ok, vmware-player and vmware-workstation have been bumped in the overlay. I haven't added them to the tree yet, because I'm still working out some kinks in the new modules. For some reason, vmware decided to bump the module version number, which creates headaches (and a new package vmware-modules-1.0.0.20) for us. I have yet to investigate what vmware-server-1.0.6 needs, but I'll try and work on that in the next few days. If I get hit by a bus or people think I'm taking too long or anything, the vmware overlay's where to look for the bumps for this bug... 5:) *** Bug 224861 has been marked as a duplicate of this bug. *** Mike, thanks for preparing testing ebuilds in the overlay. I hope they are recent enough to also take care of the issues mentioned here: http://www.vmware.com/security/advisories/VMSA-2008-0009.html *** Bug 224927 has been marked as a duplicate of this bug. *** We've got testing ebuilds for: vmware-player-2.0.4.93057 vmware-workstation-6.0.4.93057 Sounds like we still need: vmware-server-1.0.6.91891 vmware-player-1.0.7.91707 vmware-workstation-5.5.7.91707 Hopefully I'll get those ready this weekend... That would be cool. Let me know, if you need someone for testing. *** Bug 225051 has been marked as a duplicate of this bug. *** *** Bug 225343 has been marked as a duplicate of this bug. *** Ok, It turns out the following were easy to bump, and are now in the vmware overlay: vmware-server-1.0.6.91891 vmware-player-1.0.7.91707 vmware-workstation-5.5.7.91707 They'll probably be quite easy to push into the tree, and should happen in the next couple of days. The other two should remain in testing in the overlay for the next week. We need as many eyes as possible testing the following versions to ensure that the new modules are all working ok... vmware-player-2.0.4.93057 vmware-workstation-6.0.4.93057 Thanks 5:) sorry, but where's the overlay ? You can test it out using layman (emerge layman; layman -a vmware), or you can get it manually from http://overlays.gentoo.org/proj/vmware/ Hope that helps... 5:) ah... I just discover e new world of gentoo.... Thank's Thanks Mike! Unfortunately, I can't see vmware-server-1.0.6.91891 in the vmware layout, I sync'ed right now. Are you sure it's in there?! Tested vmware-workstation-6.0.4.93057 and vmware-modules-1.0.0.20 on amd64 with gentoo-sources-2.6.25-r4. Everything working as expected. also for me, uname -a Linux uzzmaster 2.6.25-gentoo-r4 #1 SMP PREEMPT Thu Jun 5 01:02:02 CEST 2008 x86_64 Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz GenuineIntel GNU/Linux uzzmaster ~ # emerge vmware-modules vmware-workstation -pv These are the packages that would be merged, in order: Calculating dependencies... done! [ebuild R ] app-emulation/vmware-modules-1.0.0.20 0 kB [1] [ebuild Rf ] app-emulation/vmware-workstation-6.0.4.93057 0 kB [1] Total: 2 packages (2 reinstalls), Size of downloads: 0 kB Fetch Restriction: 1 package Portage tree and overlays: [0] /usr/portage [1] /usr/local/portage uzzmaster ~ # Ouch. I just forgot to change the PORTAGE_OVERLAY. :( 1.0.6 works without any problems here. Ok, The tree now contains: vmware-player-1.0.7.91707 vmware-player-2.0.4.93057 vmware-server-1.0.6.91891 vmware-server-console-1.0.6.91891 vmware-workstation-5.5.7.91707 vmware-workstation-6.0.4.93057 Please let me know if there are any problems or any further work needed for this bug... 5:) Sorry, also whilst it occurs to me, vmware-workstation-4.5.3 was published in 2005 and was the last update for the 4.5 series (it's downloadable but no longer updated by vmware). Given the two or three recent security bugs with vmware packages, it should really be masked for removal due to lack of upstream support. Unfortunately, I have the feeling there may still be people using it (because it's a pay for product and they may not want to pay to upgrade). So what's the recommendation for it? Mask it or not? (In reply to comment #21) > So what's the recommendation for it? Mask it or not? Should have been done so,long, long ago. VMware Workstation 4.5.3.19414-r7 is already marked vulnerable by several GLSAs, and since it is not slotted, users are therefore advised to upgrade. I agree it should also be removed from the tree in a timely fashion, either by just "cvs rm" or prior mask, at your choice. As for VMware 5.5, it will reach end of life at Nov. 09 2008. We should be prepared to have the 6.0 branch stable prior to that, so people can start upgrading their installations rather sooner than later. Arches, please test and mark stable: =app-emulation/vmware-workstation-5.5.7.91707 =app-emulation/vmware-player-1.0.7.91707 =app-emulation/vmware-server-1.0.6.91891 =app-emulation/vmware-server-console-1.0.6.91891 Target keywords : "amd64 release x86" x86 stable amd64 stable for the vmware-server and vmware-server-console packages (alas - I don't have a workstation license to test) amd64 stable, all arches done. Re Comment #25: Ah, sorry, but is 5.5.7.91707 really marked stable? Just sync'd, and it is still masked ~x86. Thanks! In ../vmware-workstation/vmware-workstation-5.5.7.91707.ebuild: [...] KEYWORDS="-* amd64 ~x86" [...] (In reply to comment #28) > Re Comment #25: Ah, sorry, but is 5.5.7.91707 really marked stable? Just > sync'd, and it is still masked ~x86. Thanks! > > In ../vmware-workstation/vmware-workstation-5.5.7.91707.ebuild: > > [...] > KEYWORDS="-* amd64 ~x86" > [...] Looks like you are right, I'm seeing the same in my (up-to-date) cvs checkout. Re-CC'ing x86, adjusting whiteboard. $ grep KEYW vmware-workstation/vmware-workstation-5.5.7.91707.ebuild vmware-player/vmware-player-1.0.7.91707.ebuild vmware-server/vmware-server-1.0.6.91891.ebuild vmware-server-console/vmware-server-console-1.0.6.91891.ebuild vmware-workstation/vmware-workstation-5.5.7.91707.ebuild:KEYWORDS="-* amd64 ~x86" vmware-player/vmware-player-1.0.7.91707.ebuild:KEYWORDS="-* amd64 ~x86" vmware-server/vmware-server-1.0.6.91891.ebuild:KEYWORDS="-* amd64 ~x86" vmware-server-console/vmware-server-console-1.0.6.91891.ebuild:KEYWORDS="-* amd64 ~x86" Don't see a ChangeLog entry either, so apparently something has gone wrong when committing. x86, please re-check. :) This must have slipped me...fixed (In reply to comment #30) > This must have slipped me...fixed vmware-workstation looks right now, all the other listed packages are still ~x86, at least in my cvs checkout at the time of writing this. x86 back to the fun... =) $ grep KEYW vmware-workstation/vmware-workstation-5.5.7.91707.ebuild \ vmware-server-console/vmware-server-console-1.0.6.91891.ebuild \ vmware-player/vmware-player-1.0.7.91707.ebuild \ vmware-server/vmware-server-1.0.6.91891.ebuild \ vmware-server-console/vmware-server-console-1.0.6.91891.ebuild vmware-workstation/vmware-workstation-5.5.7.91707.ebuild:KEYWORDS="-* amd64 x86" vmware-server-console/vmware-server-console-1.0.6.91891.ebuild:KEYWORDS="-* amd64 ~x86" vmware-player/vmware-player-1.0.7.91707.ebuild:KEYWORDS="-* amd64 ~x86" vmware-server/vmware-server-1.0.6.91891.ebuild:KEYWORDS="-* amd64 ~x86" vmware-server-console/vmware-server-console-1.0.6.91891.ebuild:KEYWORDS="-* amd64 ~x86" Jesse Adelman, thanks for reporting this initially, btw. ;) Could you please stop hassling my machine with your negative karma? You mess up all my commits! x86 done...I hope. :) @security- another one open since 2008 (with "all arches done") A glsa request was already filed. This issue was resolved and addressed in GLSA 201209-25 at http://security.gentoo.org/glsa/glsa-201209-25.xml by GLSA coordinator Sean Amoss (ackle). |
