[ news_security_news ]
VMware Bug Threatens Host
David Utter
Staff Writer
2008-02-28
 Insider Reports RSS Feed
A problem in the client-side Windows hosted VMWare products could let a malicious guest into the host system.
The server products from VMWare are not affected, as security vendor Trend Micro noted about the bug. However, VMWare recommends disabling shared folders as a workaround for the issue.
Core Security Technologies classified the problem as a path traversal issue:
A vulnerability was found in VMware's shared folders mechanism that grants users of a Guest system read and write access to any portion of the Host's file system including the system folder and other security-sensitive files. Exploitation of these vulnerability allows attackers to break out of an isolated Guest system to compromise the underlying Host system that controls it.
Core Security also documented their exchanges with VMWare, which began in October 2007. Promised patches for the problem never materialized, leading to Core Security publishing their advisory about the bug.
VMWare has a security notification policy in place, and Core Security followed it. The lengthy delay by VMWare seems puzzling, their response equally so in suggesting a workaround rather than delivering a true fix.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
