Slashdot Mirror
Critical VMware Vulnerability, Exploit Released
BaCa writes "Core Security has issued an advisory disclosing a vulnerability that could severely impact organizations relying on VMware's desktop virtualization software. It involves directory traversal using VMware's shared folders, and could allow an attacker access to the host system from a guest VM. Core also released an exploit for the vulnerability."
It only affects the desktop systems. Interesting to see vulnerabilities finally start cropping up in the panacea virtualization techs.
But, this isn't a very big deal.
I have played with the shared folder feature, but never saw any real advantage over just using standard networking (SMB, NFS etc.) Is there some advantage to VMware's shared folder feature that I am too blind to see?
VMware's shared folders mechanism has always been a security hole waiting to happen (VMware's own docs pretty much admit that). I don't use them on servers at all, nor on any desktop where security has anything to do with the reason I'm using virtualization.
I always use SSH as transfer between the host and guest environment, yes it is slower but so much saver.
This doesnt affect VMWare server though,which most people use in home settings (given that it is free)
Legally obligatory sig : My opinions are my own... etc etc
The site announcing the vuln seems rather respectful. Why on earth would they release the PoC code to the public (non-compiled and thus easy to integrate) instead of just *saying* they had tested and proven it and sent the code and their findings to VMWare? I guess it generates more clicks and thus more ad revenue, but still.
serious, even critical flaw, but still not -that- bad. A short term workaround involves turning off the file sharing feature.
And really, if you are running vmware for high security and server isolation you would NEVER have that on anyway. Because the existence of a shared folder is implicitly not isolation.
And the value in vmware is not 'high security' but 'high utilisation'. The ability to run multiple low load systems on one hardware platform, while not having to worry about package dependency, compatibility, or even that they run on the same OS. And the ease at which you can move one virtualized 'server' to another hardware instance, and other server management conviences.
VMWare as a security mechanism? Its pretty good I suppose. In theory you can approach the same level of security you would have by using separate boxes for the servers. But that's it... you can only approach, you're never going to reach parity, and you certainly aren't going to exceed it.
So VMWare is a security tradeoff... you trade a bit of security for better cash, space, and cpu utilisation.
That said, VMware security is quite good. Its a much smaller attack surface than, say, a chroot jail. But there is still an attack surface. If you want the highest possible security, dedicated hardware behind a firewall is, was, and probably always will be the best solution.
In closing, I'm sure we'll see a proper fix for this in short order.
from TFA: not only does this feature need to be enabled but you also have to configure at least one folder for sharing. makes sense. until it gets fixed, it is best to disable the shared folders feature and use another method that has not yet been compromised.
Sigs are too short to say anything truly profound so read the above post instead.
Yes, but if you RTFA you'll see that this vulnerability allows an attacker to access any part of the host file system, not just the shared files. That is bad.
What a load of crap! Why would an obvious BS troll like that get a positive score? ...oh, right, I almost forgot what site I'm on.
But if you *ARE* jumping to conclusions, you probably need the official "Jump to Conclusions" mat available in the Office Space kit ahref=http://www.thinkgeek.com/books/humor/8e6c/rel=url2html-12174http://www.thinkgeek.com/books/humor/8e6c/>.
Layne
A load balanced network of highly available virtual servers running on my laptop...
Does that make me a bad person?
Deleted
Every piece of documentation I ever read tells you that the file sharing feature is risky and to avoid using it. Call me when they find a vulnerability in VMwaretools. I won't be surprised with that either, but other people might. The mere presence of VMwaretools on a OS tells an intruder that there is a bigger fish to catch nearby.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
whaaa?? vmware share folders have absolutly nothing to do with network shares..
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
for once my sig aplies to someone's comment..
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
The Refined Geek - Technology, Finance, Space and everything in between
Are people still taking the jerk seriously? His follow up article is horrible. He says he never mentioned "directory traversal", yet he did. He even says "I told about it before, you can't do anything useful with it." So, this "serious" problem is no big deal. He says now that Firefox could be "vulnerable by default" if there is another problem to compound this minor one. Sure, I agree that fixing minor bugs is important for security, but there is no vulnerability here, just an tempest in a teapot.
not only does this feature need to be enabled but you also have to configure at least one folder for sharing. makes sense. until it gets fixed, it is best to disable the shared folders feature and use another method that has not yet been compromised.
It's enabled by default though, at least in Fusion.
I understand it's a problem if there are vulnerabilities in the desktop virtualization products. However, I am not sure how many organizations are relying on the desktop products for secure and isolated computing. Enterprises depend upon VMWare's ESX Server and the Virtual Infrastructure products to perform large scale production consolidation where security is a huge factor. In my experience, VMWare Workstation, Server and Player are used as development platforms, where isolation is not as important.
In Beta they enabled their full drag and drop by default, but turned it off-by-default after a storm of protest on the Parallels forums. The reason for the protest is that they implemented the ability to do Mac-Windows drag and drop everywhere (instead of just to and from the Windows desktop) by creating a special magic UNC path that provided full local-user access to the root of the OS X file system.
As far as I know that's still in there, for both drag-and-drop and, if I recall correctly, for their "Coherence" mode where the Windows run in a pseudo-multi-window mode integrated to the Mac user interface.
But for those of us using an ESX environment this is not a problem.
So this might not be so safe after all?
Menus: Linux=function, Windows=vendor, OS X=as little as possible. Makes a statement, don't you think?
I'm pretty sad that this post got modded down so much. It really does expose a glaring fallacy--that open source is inherently more secure. Oh well, I've got Karma to burn.
It's true that more eyes can look at the code. It's true that anyone can try to fix it and then submit a patch. But it requires action for this to be the case. Firefox is a classic example of a major open source project which consistently has security holes left unpatched. It's a major project, people! It's practically the poster-child for alternatives to Microsoft software! Fix the damned bugs!
This is a great example of how virtual machines can actually reduce security (something that Theo de Raadt said not that long ago, and was lambasted for.) Here's a case where a local exploit in the guest could turn into a root exploit in the host--all by virtual of the fact that virtual machines (necessarily) run as root on the host. Even if they didn't run as root, it would allow two local exploits (one on the guest and one on the host), and presumably the possible infection of other guests running under the same local user.
I'm always careful to run potentially vulnerable applications like this in a secure virtual environment.
Today's Sesame Street was brought to you by the number e.
If people used a real Web browser, preferably on a 100% secure OS like OS 10, these security issues would not be a problem.
If I read the description correctly, it's a local exploit - the advisory says it's remotely exploitable, but it sounds like a remote user would have to be able to log into your virtualized system (using something like RDP). It seems like it'd be unusual to allow remote users to connect to a virtualized OS on a desktop.
On those rare instances I run VMware Fusion, it's NATted. Fortunately the main use I have for Windows anymore is just to test web page breakage on IE.
#DeleteChrome
I totally agree with you. Sadly I don't mod anymore.
We are Turing O-Machines. The Oracle is out there.
Just goes to show that you should always run VMWare in its own separate virtual machine (perhaps using Bochs or QEMU) to avoid security problems.
-- Ed Avis ed@membled.com
Only Windows hosts are vulnerable. Linux hosts aren't. Why is that?
Answer: On Linux, no MultiByteToWideChar conversion is necessary, so the VMware developers can't screw it up.
VMware developers are at fault, but Microsoft's complicated design shares some of the blame.
Microsoft boasts a great user interface, but the interface they provide to developers (developers, developers, Steve!) is utter crap.
Yeesh.
http://outcampaign.org/
Please provide references to security holes left in Firefox for long periods of time. Note that other categories of bugs do not count (if it doesn't create a risk of exploit, it doesn't count). Thank you.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Update: Microsoft is more at fault than I thought. Apparently MultiByteToWideChar decodes overlong forms of UTF-8, thus (irresponsibly, IMHO) violating RFC 3629 and allowing this problem to occur in the first place.
VMware should have been able to trust the OS to do proper UTF-8 decoding.
http://outcampaign.org/
Why do VMs have to run as root?
No, this is an example of a poor implementation of shared folders. This does not invalidate the use of virtual machines as a security mechanism. However, I will repeat what I said before on this subject: Virtualization solves an availability problem not a security problem.
He was lambasted for creating a controversy that didn't exist just so that he would be mention in the press. Theo is that you?
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
Generally, they access privileged instructions and memory, and they run code directly on the processor. A pure software emulator would not have this requirement.
Ad hominem attacks are great for when you don't actually have a point to make, aren't they? Thanks for showing yourself to be the troll that you are.
lol.
DRM: Terminator crops for your mind!
If you run one of the affected VMWare products, and have host folder sharing enabled, and run either a piece of software or a trojan horse virtual machine(i.e. that you downloaded or otherwise shared) with exploit code in in it, then that software can access your host machine with elavated privledges to at the very least the same as the logged in user on the host machine, and possibly to the administrator level.
..'s in it that are not filtered out or caught by vmware, and therefore access anywhere on the host machine with the same privledges as the VMware host software.
Essentially what it says is that the vmware host folder sharing mechanism does not properly limit access to the host machine to the mapped folders -- tricks in how MCBS-Unicode conversions take place allow a carefully encoded path to include
Workaround: Disable host folder sharing, and be careful about how much you trust shared VM's and software running on a VM image you build yourself.
More Caffeine. NOW
Exactly, many people will sell you tons of software to *improve* your security when that software itself is generally the source of many vulnerabilities. Virtualization software is on example, the other, that surprised me when i found out, was anti-virus software.
Every software layer has bugs, and a sizable number of these bugs, are explotable security bugs.
PS: I work for Core Security with those guys. Kudos to Gera who discovered and Nico who Exploited it!
That was a good one!
See grandparent, the one marked as Troll.
Not that I care too much about how my comment is modded (let me just say I don't feel sorry for other people's stupidity), but it's still a bit sad to see that a comment with _material_ (no matter what the opinion is) gets this kind of treatment.
Forgive me, but "no shit". Any process you run on your machine reduces security by it's very nature. However, it's still true that there is an overall net gain in security by wrapping up highly exposed processes in a VM and calling it a day ( sendmail anyone? ). While it's true that VMs are software and software has bugs ( always has and always will ), compare gaining access to a guest OS with gaining access to the host OS ( which, any OS running without a guest is considered for the purposes of this discussion ). In a guest, you would still have to exploit a bug which hasn't been patched to gain access to the host, and then you may still be limited depending on the particular exploit involved.
Theo may have had a valid point, I haven't read his comments, but the fact of the matter is that VMs are inherently more secure than running the service straight on the host.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
This is a Microsoft only issue. Only the "windows" hosted VMware workstation is affected. Non of the Linux versions are affected. I know it could be considered flamebait, however it's just "clarification".
I say things which affects my Karma negatively. (and I don't care) For instance; All religion is false.
Ad hominem attack? No point being made? Troll? A little harsh don't cha think?
BTW, in order for it to be an Ad hominem attack, I would have to say that Virtual Machines are secure because Theo is an idiot. I didn't say that, and I don't think Theo is an idiot.
So let me break it down for you:
My point was that VMware adding a poorly implemented feature called "shared folders" does not invalidate the argument that VM can be used to improve security.
For example, If you chose to not use "shared folders" and instead used network services to access files on the host OS, you would have compartmentalized the risk from vulnerabilities to within the guest OS. You could further mitigate the risk by having automated backups and sane permissions applied to the shared files.
I further repeated my stance that VM (in an enterprise setting) solves an availability problem, and was not really designed for improving security. Security was just a nice byproduct.
I could have said "Your example is just as valid as saying 'Problems and exploits found in Windows are perfect examples of why using an operating system to run application software within a given hardware platform is a bad idea'." But that would have been silly, and not have added anything to the conversation but a smartass example of how one buggy VM doesn't invalidate all VMs.
I didn't attack Theo. I pointed out that Theo wasn't lambasted for his criticism of VM as a way of improving security, instead he was lambasted for the way the topic came about. Asking if you were Theo was a humorous jab...
Anyway, the "lambasting" was like this fictional exchange between Jack, Jill and their peers (I know it's a silly oversimplification):
Jack: Cardboard boxes make crappy apple pies!
Jill: Of course, cardboard boxes make crappy apple pies. We didn't make the boxes to put in the pie, we made them so we can carry more than one pie at a time.
Jack: Well I heard that some people were using cardboard boxes to make apple pies, and I wanted to voice my concern.
Peers: Well Duh. We already knew the proper use of cardboard boxes. Way to keep yourself topical Jack.
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...