VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues

               VMware Security Advisory

The VMware Descheduled Time Accounting Service is an optional,
experimental service that provides improved guest operating system
accounting.

This patch fixes a denial of service vulnerability that could be
triggered in a virtual machine by an unprivileged, locally
logged-on user in the virtual machine.

Virtual machines are affected under the following conditions:

- The virtual machine is running a Windows operating system.

- The VMware Descheduled Time Accounting driver is installed
  in the virtual machine. Note that this is an optional &#40;non-
  default&#41; part of the VMware Tools installation.

- The VMware Descheduled Time Accounting Service is not running
  in the virtual machine

The VMware Descheduled Time Accounting Service is no longer provided
in newer versions of VMware Tools, starting with the versions
released in Fusion 2.0.2 and ESX 4.0.

However, virtual machines migrated from vulnerable releases will
still be vulnerable if the three conditions listed above are met,
until their tools are upgraded.

Steps needed to remediate this vulnerability:

Guest systems on VMware Workstation, Player, ACE, Server, Fusion
 - Install the new version of Workstation, Player, ACE, Server,
   Fusion &#40;see below for version information&#41;
 - Upgrade tools in the virtual machine &#40;virtual machine users
   will be prompted to upgrade&#41;.

Guest systems on ESX 3.5, ESXi 3.5, ESX 3.0.2, ESX 3.0.3
 - Install the relevant patches &#40;see below for patch identifiers&#41;
 - Manually upgrade tools in the virtual machine &#40;virtual machine
   users will not be prompted to upgrade&#41;.  Note the VI Client will
   not show the VMware tools is out of date in the summary tab.
   Please see http://tinyurl.com/27mpjo page 80 for details.

Guests systems on ESX 4.0 and ESXi 4.0 that have been migrated from
ESX 3.5, ESXi 3.5, and ESX 3.0.x
 - Install/upgrade the new tools in the virtual machine &#40;virtual
   machine users will be prompted to upgrade&#41;.

If the Descheduled Time Accounting driver was installed, the tools
upgrade will result in an updated driver for Workstation, Player,
ACE, Server, ESX 3.0.2, ESX 3.0.3, ESX 3.5, ESXi 3.5. For Fusion,
ESX 4.0, and ESXi 4.0 the tools upgrade will result in the removal
of the driver.

VMware would like to thank Nikita Tarakanov for reporting this
issue to us.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the name CVE-2009-1805 to this issue.

The following table lists what action remediates the vulnerability
&#40;column 4&#41; if a solution is available. See above for remediation
details.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
VirtualCenter  any       Windows  not affected

Workstation    6.5.x     any      6.5.2 build 156735 or later
Workstation    6.0.x     any      upgrade to at least 6.5.2

Player         2.5.x     any      2.5.2 build 156735 or later
Player         2.0.x     any      upgrade to at least 2.5.2

ACE            2.5.x     Windows  2.5.2 build 156735 or later
ACE            2.0.x     Windows  upgrade to at least 2.5.2

Server         2.x       any      2.0.1 build 156745 or later
Server         1.x       any      1.0.9 build 156507 or later

Fusion         2.x       Mac OS/X 2.0.2 build 147997 or later

ESXi           4.0       ESXi     not affected
ESXi           3.5       ESXi     ESXe350-200904402-T-BG

ESX            4.0       ESX      not affected
ESX            3.5       ESX      ESX350-200904401-BG
ESX            3.0.3     ESX      ESX303-200905401-SG
ESX            3.0.2     ESX      ESX-1008420
ESX            2.5.5     ESX      not affected

The libpng packages contain a library of functions for creating and
manipulating PNG &#40;Portable Network Graphics&#41; image format files.

A flaw was discovered in libpng that could result in libpng trying
to free&#40;&#41; random memory if certain, unlikely error conditions
occurred. If a carefully-crafted PNG file was loaded by an
application linked against libpng, it could cause the application
to crash or, potentially, execute arbitrary code with the
privileges of the user running the application.

A flaw was discovered in the way libpng handled PNG images
containing &quot;unknown&quot; chunks. If an application linked against libpng
attempted to process a malformed, unknown chunk in a malicious PNG
image, it could cause the application to crash.

The Common Vulnerabilities and Exposures project &#40;cve.mitre.org&#41;
has assigned the names CVE-2009-0040 and CVE-2008-1382 to these
issues.

The VMware version number of libpng after applying the update is
libpng-1.0.14-12.i386.rpm.

The following table lists what action remediates the vulnerability
&#40;column 4&#41; if a solution is available.

VMware         Product   Running  Replace with/
Product        Version   on       Apply Patch
=============  ========  =======  =================
VirtualCenter  any       Windows  not affected

hosted *       any       any      not affected

ESXi           4.0       ESXi     not affected
ESXi           3.5       ESXi     not affected

ESX            4.0       ESX      not affected
ESX            3.5       ESX      not affected
ESX            3.0.3     ESX      not affected
ESX            3.0.2     ESX      not affected
ESX            2.5.5     ESX      Upgrade Patch 13

VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues

VMware Workstation 6.5.2

VMware Player 2.5.2

VMware ACE 2.5.2

VMware Server 2.0.1

VMware Server 1.0.9

VMware Fusion 2.0.4

ESXi

ESX

VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues

VMware Workstation 6.5.2

VMware Player 2.5.2

VMware ACE 2.5.2

VMware Server 2.0.1

VMware Server 1.0.9

VMware Fusion 2.0.4

ESXi

ESX

Related