Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[gentoo-announce] GLSA: vmware-workstation (200308-03)
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
pilla
Bodhisattva
Bodhisattva


Joined: 07 Aug 2002
Posts: 7729
Location: Underworld

PostPosted: Mon Aug 25, 2003 2:22 pm    Post subject: [gentoo-announce] GLSA: vmware-workstation (200308-03) Reply with quote

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200308-03
- - - ---------------------------------------------------------------------

PACKAGE : vmware-workstation
SUMMARY : local full host access
DATE : 2003-08-25 13:44 UTC
EXPLOIT : local
VERSIONS AFFECTED : <vmware-workstation-4.0.1-5289 <vmware-workstation-3.2.1-2242
FIXED VERSION : >=vmware-workstation-4.0.1-5289 >=vmware-workstation-3.2.1-2242
CVE : CAN-2003-0480 CAN-2003-0631

- - - ---------------------------------------------------------------------

- From advisory:
"By manipulating the VMware GSX Server and VMware Workstation
environment variables, a program such as a shell session with
root privileges could be started when a virtual machine is
launched. The user would then have full access to the host."


Read the full advisories at:
http://www.securityfocus.com/archive/1/330184


SOLUTION

It is recommended that all Gentoo Linux users who are running
app-emulation/vmware-workstation upgrade to either vmware-workstation-3.2.1-2242
or vmware-workstation-4.0.1-5289 follows:

emerge sync
emerge vmware-workstation-<VERSION>
emerge clean

- - - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz
- - - ---------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/ShLGfT7nyhUpoZMRAuZpAJ9hbaB1L9bpaEZ+dxriK5gkq91WoACfTbak
ypAHrWqhBJVhCa7TpYxXsTk=
=JHk+
-----END PGP SIGNATURE-----
_________________
"I'm just very selective about the reality I choose to accept." -- Calvin
Back to top
View user's profile Send private message
pilla
Bodhisattva
Bodhisattva


Joined: 07 Aug 2002
Posts: 7729
Location: Underworld

PostPosted: Mon Aug 25, 2003 8:11 pm    Post subject: Reply with quote

Carlo wrote:
According to http://www.vmware.com/support/ws4/doc/releasenotes_ws4.html vmware-workstation-4.0.1-5289 is affected, too, so the GLSA is not correct.


Carlo

_________________
"I'm just very selective about the reality I choose to accept." -- Calvin
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum