SecurityFocus recently posted a bulletin alert about a security vulnerability it found in VMware's Workstation 6.0 for Windows product, and it could possibly exist in other VMware poducts as well.
The type of vulnerability being reported is a DoS (Denial of Service) vulnerability causing a potential privilege escalation.
It writes:
I found a vulnerability in VMware Workstation 6.0 which allows an unprivileged user in the host OS to crash the system and potentially run arbitrary code with kernel privileges.
The issue is in the vmstor-60 driver, which is supposed to mount VMware images within the host OS. When sending the IOCTL code FsSetVoleInformation with subcode FsSetFileInformation with a large buffer and underreporting its size to at max 1024 bytes, it will underrun and potentially execute arbitrary code.
Interestingly the vmstor driver (which is the old version supposed to mount VMware images prior to version 6.0) is not vulnerable.
I have originally reported this vulnerability on 21-May-07 and got response from the VMware security team, but so far the investigation hasn't gone any further and no update has been released.
The steps to reproduce are:
- get DC2.exe from the latest Windows Driver Kit
- login as unprivileged user
- run "dc2 /hct \Device\vstor-ws60"
The workaround:
Disable the vstor-ws60 driver in the device manager. This will disable the VMware Virtual Image Mounter.
Read the original, here.