VMware Player, Server, Workstation: Multiple vulnerabilities Multiple vulnerabilities have been found in VMware Player, Server, and Workstation, allowing remote and local attackers to conduct several attacks, including privilege escalation, remote execution of arbitrary code, and a Denial of Service. vmware-server vmware-player vmware-workstation 2012-09-29 2012-09-29 213548 224637 236167 245941 265139 282213 297367 335866 385727 local, remote 2.5.5.328052 6.5.5.328052 1.0.9.156507

VMware Player, Server, and Workstation allow emulation of a complete PC on a PC without the usual performance overhead of most emulators.

Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details.

Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information.

A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.

Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).

There is no known workaround at this time.

Gentoo discontinued support for VMware Player. We recommend that users unmerge VMware Player:

# emerge --unmerge "app-emulation/vmware-player"

NOTE: Users could upgrade to “>=app-emulation/vmware-player-3.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Workstation:

# emerge --unmerge "app-emulation/vmware-workstation"

NOTE: Users could upgrade to “>=app-emulation/vmware-workstation-7.1.5”, however these packages are not currently stable.

Gentoo discontinued support for VMware Server. We recommend that users unmerge VMware Server:

# emerge --unmerge "app-emulation/vmware-server" CVE-2007-5269 CVE-2007-5503 CVE-2007-5671 CVE-2008-0967 CVE-2008-1340 CVE-2008-1361 CVE-2008-1362 CVE-2008-1363 CVE-2008-1364 CVE-2008-1392 CVE-2008-1447 CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 CVE-2008-2098 CVE-2008-2100 CVE-2008-2101 CVE-2008-4915 CVE-2008-4916 CVE-2008-4917 CVE-2009-0040 CVE-2009-0909 CVE-2009-0910 CVE-2009-1244 CVE-2009-2267 CVE-2009-3707 CVE-2009-3732 CVE-2009-3733 CVE-2009-4811 CVE-2010-1137 CVE-2010-1138 CVE-2010-1139 CVE-2010-1140 CVE-2010-1141 CVE-2010-1142 CVE-2010-1143 CVE-2011-3868 system ackle