Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 245941 (CVE-2008-4915) - app-emulation/vmware* <126128/126538 Multiple vulnerabilities (CVE-2008-{4915,4916,4917})
Summary: app-emulation/vmware* <126128/126538 Multiple vulnerabilities (CVE-2008-{4915...
Status: RESOLVED FIXED
Alias: CVE-2008-4915
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://lists.vmware.com/pipermail/sec...
Whiteboard: B1 [glsa]
Keywords:
: 249632 (view as bug list)
Depends on:
Blocks: 242782 246856
  Show dependency tree
 
Reported: 2008-11-07 10:52 UTC by Stefan Behte (RETIRED)
Modified: 2012-09-29 16:26 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2008-11-07 10:52:31 UTC
Quoting from the vmware advisory:

1. Summary

   VMware Hosted products and patches for ESX and ESXi resolve multiple
   security issues. A flaw in the CPU hardware emulation may allow for a
   privilege escalation on virtual machine guest operating systems. In
   addition a directory traversal issue is resolved.

We have:
app-emulation/vmware-server-1.0.7
app-emulation/vmware-workstation-5.5.8
app-emulation/vmware-workstation-6.0.5
app-emulation/vmware-player-1.0.8
app-emulation/vmware-player-2.0.5
Comment 1 Mike Auty gentoo-dev 2008-11-09 21:24:04 UTC
Ok, now in the tree are:

app-emulation/vmware-player-1.0.9.126128
app-emulation/vmware-player-2.5.0.118166
app-emulation/vmware-workstation-5.5.9.126128
app-emulation/vmware-workstation-6.5.0.118166
app-emulation/vmware-server-1.0.8.126538
app-emulation/vmware-server-console-1.0.8.126538

Ready for testing/stabilization/masking as necessary...
Comment 2 Christian Hoffmann (RETIRED) gentoo-dev 2008-11-09 21:32:33 UTC
Arches, please test and stabilize:
  =app-emulation/vmware-player-1.0.9.126128
  =app-emulation/vmware-workstation-5.5.9.126128
  =app-emulation/vmware-server-1.0.8.126538
  =app-emulation/vmware-server-console-1.0.8.126538

Target keywords: amd64 x86
Comment 3 Stefan Behte (RETIRED) gentoo-dev Security 2008-11-30 16:16:12 UTC
*PING*
Comment 4 Markus Meier gentoo-dev 2008-11-30 17:33:09 UTC
this version (at least of the player) wants app-emulation/vmware-modules-1.0.0.15-r1, which won't build with with 2.6.26 kernels...
Comment 5 Jeroen Roovers (RETIRED) gentoo-dev 2008-12-02 21:26:38 UTC
*** Bug 249632 has been marked as a duplicate of this bug. ***
Comment 6 Justin Rittenhouse 2008-12-03 20:08:13 UTC
Echoing comment #4 for vmware-server as well, amd64...pulling in app-emulation/vmware-modules-1.0.0.15-r1 which doesn't compile on 2.6.26.
Comment 7 Robert Buchholz (RETIRED) gentoo-dev 2008-12-17 15:30:43 UTC
This also resolves VMSA-2008-0019 / CVE-2008-4917.
Comment 8 Robert Buchholz (RETIRED) gentoo-dev 2008-12-17 15:36:55 UTC
CVE-2008-4917 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4917):
  Unspecified vulnerability in VMware Workstation 5.5.8 and earlier,
  and 6.0.5 and earlier 6.x versions; VMware Player 1.0.8 and earlier,
  and 2.0.5 and earlier 2.x versions; VMware Server 1.0.9 and earlier;
  VMware ESXi 3.5; and VMware ESX 3.0.2 through 3.5 allows guest OS
  users to have an unknown impact by sending the virtual hardware a
  request that triggers an arbitrary physical-memory write operation,
  leading to memory corruption.

Comment 9 Tobias Heinlein (RETIRED) gentoo-dev 2009-01-02 14:16:19 UTC
gentoo-sources-2.6.27-r7 is now stable on amd64 and x86. Please test and report.
Comment 10 Mike Auty gentoo-dev 2009-01-10 13:13:21 UTC
I've now wrestled with vmware-modules-1.0.0.15 and -r2 should work with the latest (2.6.28) kernel and older, so please have a go at restabilizing these...

Also, we've had vmware-workstation-6.5.1.126130 and vmware-player-2.5.1.126130 builds in the tree for a while now (although be aware of bug 254148).
Comment 11 Markus Meier gentoo-dev 2009-01-11 22:10:13 UTC
amd64/x86 should all be done...
Comment 12 Mike Auty gentoo-dev 2009-01-11 22:22:08 UTC
Thanks Markus, but it looks like you stabled the old versions (from bug 236167) rather than this one.  Sorry, but we could do with the following stabilized please:

vmware-modules-1.0.0.15-r2 (done)
vmware-modules-1.0.0.23
vmware-player-1.0.9.126128
vmware-player-2.5.1.126130
vmware-workstation-5.5.9.126128
vmware-workstation-6.5.1.126130
vmware-server-1.0.8.126538
vmware-server-console-1.0.8.126538

Sorry about that...  5:(
Comment 13 Markus Meier gentoo-dev 2009-01-12 21:51:28 UTC
(In reply to comment #12)
> Thanks Markus, but it looks like you stabled the old versions (from bug 236167)
> rather than this one.  Sorry, but we could do with the following stabilized
> please:
> 
> vmware-modules-1.0.0.15-r2 (done)
> vmware-modules-1.0.0.23
> vmware-player-1.0.9.126128
> vmware-player-2.5.1.126130
> vmware-workstation-5.5.9.126128
> vmware-workstation-6.5.1.126130
> vmware-server-1.0.8.126538
> vmware-server-console-1.0.8.126538
> 
> Sorry about that...  5:(

should all be done now.
Comment 14 Stefan Behte (RETIRED) gentoo-dev Security 2009-01-13 19:14:32 UTC
GLSA together with 224637,245941,213548 
Comment 15 Alex Legler (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2009-04-06 18:58:54 UTC
CVE-2008-4916 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4916):
  Unspecified vulnerability in a guest virtual device driver in VMware
  Workstation before 5.5.9 build 126128, and 6.5.1 and earlier 6.x
  versions; VMware Player before 1.0.9 build 126128, and 2.5.1 and
  earlier 2.x versions; VMware ACE before 1.0.8 build 125922, and 2.5.1
  and earlier 2.x versions; VMware Server 1.x before 1.0.8 build 126538
  and 2.0.x before 2.0.1 build 156745; VMware Fusion before 2.0.1;
  VMware ESXi 3.5; and VMware ESX 3.0.2, 3.0.3, and 3.5 allows guest OS
  users to cause a denial of service (host OS crash) via unknown
  vectors.

Comment 16 Andreas K. Hüttel gentoo-dev 2010-07-14 21:09:40 UTC
@security: and what's the status here?
Comment 17 Stefan Behte (RETIRED) gentoo-dev Security 2010-08-01 13:42:01 UTC
A GLSA still needs to be written. As the security team is short-handed, and the backlog queue is large, this has not happened yet.
Comment 18 GLSAMaker/CVETool Bot gentoo-dev 2012-09-29 16:26:20 UTC
This issue was resolved and addressed in
 GLSA 201209-25 at http://security.gentoo.org/glsa/glsa-201209-25.xml
by GLSA coordinator Sean Amoss (ackle).