Slashdot Log In
Critical VMware Vulnerability, Exploit Released
Posted by
kdawson
on Thu Feb 28, 2008 02:41 PM
from the heads-up-incoming dept.
from the heads-up-incoming dept.
BaCa writes "Core Security has issued an advisory disclosing a vulnerability that could severely impact organizations relying on VMware's desktop virtualization software. It involves directory traversal using VMware's shared folders, and could allow an attacker access to the host system from a guest VM. Core also released an exploit for the vulnerability."
Related Stories
Submission: VMware: Critical Vulnerability and Exploit by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Limited issue (Score:3, Interesting)
But, this isn't a very big deal.
Re:Limited issue (Score:5, Insightful)
Parent
Re: (Score:2)
Re: (Score:2)
Anyone using Shared Folders is just asking for trouble anyway
I second that. Shared Folders is a bad idea and shouldn't exist. I suspect some "big customer" has VMware convinced the sky will fall should they not provide f<bleep/>ing Shared Folders. I hope that customer gets badly owned by this nonsense. You deserve it. This is purely self-inflicted and you should be laughed at and fired. With any luck the PHB you work for cracks his own jaw with the predictable knee jerk reaction and makes you put in a several weekends disabling every "Shared Folders" ins
Why use the shared folder feature? (Score:5, Insightful)
Re:Why use the shared folder feature? (Score:5, Informative)
Of course, if you're using desktop product (like VMWare Server) you can always do host-only networking and limit your shares to the host-only interfaces. But that's a little more work.
Parent
Re:Why use the shared folder feature? (Score:5, Informative)
Parent
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
I have played with the shared folder feature, but never saw any real advantage over just using standard networking (SMB, NFS etc.) Is there some advantage to VMware's shared folder feature that I am too blind to see?
Yes. 8^)
I'm a little conservative about security, so I run a snapshotted Windows XP under VMWare with the network interface disabled unless I absolutely need it. Shared folders allow me to access and save all the files I work on in this environment.
... Needless to say, I'll be re-evaluating my approach once I've had a chance to look at exactly how this directory traversal exploit works.
Don't do that, then! (Score:5, Informative)
Re: (Score:3, Informative)
Best to use SSH... (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
First of all, what if you're bridging? Does the OS snag the packet that's destined for its interface, or does it forward to the switch first?
Second, lots of people don't set up FTP anymore, due to better alternatives. What other options would you use? You could use Samba--again, if you have it set up.
Usually, I'd also use scp, but I'd use a weak (and fast) encryption mechanism. It's a shame that OpenSSH got rid of the "no encryption" cipher. I
Re: (Score:2)
Re:Best to use SSH... (Score:5, Informative)
it definitely goes through the host's network stack, which is inefficient but convenient i guess.
its actually bloody annoying that vmware pays any attention to the hosts nic's link state, as if you're not connected to a switch/wlan, then you have no networking (unless you have a handy loopback cable!) and have to switch to host-only mode.
i'm getting a bit fed-up of vmware server though, especially that awful web gui in v2 beta, and they still haven't fixed the solaris10 networking issues that they've known about since before it was a "supported" guest os (try using nfs/jumpstart under vmware).
unfortunately i don't have the hardware to make xen/kvm useful, and virtualbox is a bit "unpolished" to be kind, seen bad reviews of parallels on the mac, so the linux version is probably worse.
Parent
Re: (Score:2)
It's sad that there aren't any good, robust virtual machine solutions out there. VMWare really does seem to be the best on all platforms, though trying to use anything non-Windows/Linux is probably going to be frustrating.
Xen really isn't much better. They have support for Windows on machines with hardware virtualization instructions, but more obscure operating systems just don't get support.
Doesnt affect Server (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
serious, even critical flaw, but still not (Score:5, Insightful)
And really, if you are running vmware for high security and server isolation you would NEVER have that on anyway. Because the existence of a shared folder is implicitly not isolation.
And the value in vmware is not 'high security' but 'high utilisation'. The ability to run multiple low load systems on one hardware platform, while not having to worry about package dependency, compatibility, or even that they run on the same OS. And the ease at which you can move one virtualized 'server' to another hardware instance, and other server management conviences.
VMWare as a security mechanism? Its pretty good I suppose. In theory you can approach the same level of security you would have by using separate boxes for the servers. But that's it... you can only approach, you're never going to reach parity, and you certainly aren't going to exceed it.
So VMWare is a security tradeoff... you trade a bit of security for better cash, space, and cpu utilisation.
That said, VMware security is quite good. Its a much smaller attack surface than, say, a chroot jail. But there is still an attack surface. If you want the highest possible security, dedicated hardware behind a firewall is, was, and probably always will be the best solution.
In closing, I'm sure we'll see a proper fix for this in short order.
Re:serious, even critical flaw, but still not (Score:5, Informative)
Actually, if you are running vmware for high security and server isolation you are running it on ESX, or at least VMware Server. Neither of which are vulnerable to this exploit.
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Actually, if you are running vmware for high security and server isolation you are running it on ESX, or at least VMware Server. Neither of which are vulnerable to this exploit.
You're probably also running it on a unix.
The description says basically that Windows' MultiByteToWideChar takes invalid UTF8 and unless you specifically tell it not to it allows errors such as expressing 7-bit characters as several bytes (or probably also allowing the longer variations of any character). Valid UTF8 only allows the smallest possible representation of a character. So vmware checks for "..", but the string is really more like "{4 zero bit}.{4 zero bits}." that when converted from utf8 to w
I currently have (Score:2)
Does that make me a bad person?
Re: (Score:2)
Nice! I'm working on Capistrano deployment stuff and so my Macbook is running a couple of FC8 VMs. It's not happy about it either...
Parallels Desktop has a similar problem... (Score:5, Interesting)
As far as I know that's still in there, for both drag-and-drop and, if I recall correctly, for their "Coherence" mode where the Windows run in a pseudo-multi-window mode integrated to the Mac user interface.
No Problem For Me (Score:4, Funny)
Does this really impact many people? (Score:2)
On those rare instances I run VMware Fusion, it's NATted. Fortunately the main use I have for Windows anymore is just to test web page breakage on IE.
More virtualization is the answer (Score:2, Funny)
Anyone notice how Linux hosts aren't vulnerable? (Score:2)
Only Windows hosts are vulnerable. Linux hosts aren't. Why is that?
Answer: On Linux, no MultiByteToWideChar conversion is necessary, so the VMware developers can't screw it up.
VMware developers are at fault, but Microsoft's complicated design shares some of the blame.
Microsoft boasts a great user interface, but the interface they provide to developers (developers, developers, Steve!) is utter crap.
Yeesh.
Update: Microsoft is irresponsible, as usual (Score:2)
Update: Microsoft is more at fault than I thought. Apparently MultiByteToWideChar decodes overlong forms of UTF-8, thus (irresponsibly, IMHO) violating RFC 3629 and allowing this problem to occur in the first place.
VMware should have been able to trust the OS to do proper UTF-8 decoding.
Re: (Score:2)
no, we pounce on them if they don't bother to fix this... ever.
from TFA:
not only does this feature need to be enabled but you also have to configure at least one folder for sharing. makes sense. until it
Re:Closed Source (Score:5, Informative)
Parent
Re: (Score:2)
Layne
Re: (Score:2)
Re: (Score:2)
It's true that more eyes can look at the code. It's true that anyone can try to fix it and then submit a patch. But it requires action for this to be the case. Firefox is a classic example of a major open source project which consistently has security holes left unpatched. It's a major project, people! It's practically the poster-c
Re: (Score:2)
Re:Duh? (Score:5, Informative)
Parent
Re:Duh? (Score:5, Informative)
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
No, this is an example of a poor implementation of shared folders. This does not invalidate the use of virtual machines as a security mechanism. However, I will repeat what I said before on this subject: Virtualization solves an availability problem not a security problem.
He was lambasted for creating a controversy that didn't exist just so that he would
Re:Exploit code released? (Score:5, Interesting)
One day a nice whitehat sent an e-mail to all@.com describing that he had found a buffer overflow in our CGI binary that could be exploited in order to get shell access with the permissions of whatever user the webserver was running as. He told us exactly how to exploit it but he did not provide any kind of proof-of-concept code.
Well, the main developer and maintainer of the CGI program (an extremely experienced and talented programmer who is, to this day, still one of the programmers that I look up to the most - for reasons other than what I am about to describe obviously) assured everyone in the company that exploiting such a programming error would be soooooo incredibly difficult that it was a complete non-issue.
Based on his assurances the whitehat was ignored and customers were never notified of the problem and many of them went on running a vulnerable application.
I tried explaining to everyone that buffer overflows in services were exploited all the time to gain remote access but I was a junior level programmer at the time and was ignored.
I imagine that had the whitehat provided us with exploit code that we could use to actually test the problem ourselves and demonstrate it to the "non-believers" then seriousness of the problem would have been forced and the issues would have gotten a lot more attention.
Anyway, of course Core could have provided the code to VMWare only, but the basic idea is that with exploit code in the wild it gives an extra push to get VMWare to fix the problem quickly.
Parent
Re: (Score:2)
personaly i like it when they post POC's as it not only lets others see how they do it on paper insetead of in rough idea's or theory.
someone else might read the POC and see how it is exloiting this and realize that it can be used to effect something else and then inform people about that.
keeping the nature of the problem hiden from the public does not help c
Re: (Score:2)
Re: (Score:2)
cat
Attached devices:
Host: scsi2 Channel: 00 Id: 00 Lun: 00
Vendor: VMware, Model: VMware Virtual S Rev: 1.0
Type: Direct-Access ANSI SCSI revision: 02