漏洞信息详情
VMware产品Trap Flag处理本地权限提升漏洞
- CNNVD编号:CNNVD-200811-153
- 危害等级: 中危
- CVE编号: CVE-2008-4915
- 漏洞类型: 权限许可和访问控制
- 发布时间: 2008-11-10
- 威胁类型: 本地
- 更新时间: 2008-11-15
- 厂 商: vmware
- 漏洞来源: Derek Soeder※ dsoe...
漏洞简介
VMWare是一款虚拟PC软件,允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。
VMWare在处理指令的执行时存在问题,攻击者可能利用此漏洞提升自己的权限。如果在设置了Trap Flag的情况下出现中断,正确的CPU将执行转移到中断处理器之前会清除Trap Flag。对于受影响的VMware版本,如果内核态IRET设置了Trap Flag的话,则在执行单字节INT 3指令的时候Trap Flag在模式切换后仍继续存在,这造成的结果就是如果能够导致内核通过IRET设置Trap Flag的话,用户态代码在遇到INT 3断点(#BP)处理器的第一个指令的话会导致出现单步调试trap(#DB)。
漏洞公告
目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
VMWare
------
VMware Workstation 5.5.9
------------------------
http://www.vmware.com/download/ws/ws5.HTML
Release notes:
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.HTML
Windows binary:
md5sum: 509c7b323a8ac42c0a92b0a1446bb0f8
Compressed Tar archive for 32-bit Linux
md5sum: 9d189e72f8111e44b27f1ee92edf265e
Linux RPM version for 32-bit Linux
md5sum: 0957c5258d033d0107517df64bfea240
VMware Player 1.0.9
-----------------------------
http://www.vmware.com/download/player/
Release notes Player 1.x:
http://www.vmware.com/support/player/doc/releasenotes_player.HTML
Windows binary
md5sum: e2c8dd7b27df7d348f14f69de017b93f
Player 1.0.9 for Linux (.rpm)
md5sum: 471c3881fa60b058b1dac1d3c9c32c85
Player 1.0.9 for Linux (.tar)
md5sum: bef507811698e7333f5e8cb672530dbf
VMware ACE 1.0.8
----------------
http://www.vmware.com/download/ace/
Release notes:
http://www.vmware.com/support/ace/doc/releasenotes_ace.HTML
Windows binary
md5sum: 920a08c2fcdeaedcb3258183817419a0
ACE 1.0.8 for Linux (.rpm)
md5sum: 450254b73fa6802713136bf2c04e5b40
ACE 1.0.8 for Linux (.tar)
md5sum: 5efdaccf8217b8d7875d3f35cd6159e0
VMware Server 1.0.8
-------------------
http://www.vmware.com/download/server/
Release notes:
http://www.vmware.com/support/server/doc/releasenotes_server.HTML
VMware Server for Windows 32-bit and 64-bit
md5sum: 4ba41e5fa192f786121a7395ebaa8d7c
VMware Server Windows client package
md5sum: f25746e275ca00f28d44ad372fc92536
VMware Server for Linux
md5sum: a476d3953ab1ff8457735e692fa5edf9
VMware Server for Linux rpm
md5sum: af6890506618fa82928fbfba8a5f97e1
Management Interface
md5sum: 5982b84a39479cabce63e12ab664d369
VMware Server Linux client package
md5sum: 605d7db48f63211cc3f5ddb2b3f915a6
ESXi
----
ESXi 3.5 patch ESXe350-200810401-O-UG
http://download3.vmware.com/software/vi/ESXe350-200810401-O-UG.zip
md5sum: 9b83c54a005572bebb86652e3efd732a
http://kb.vmware.com/kb/1007056
ESX
---
ESX Server 3.5 update 3 CD image Refresh
md5sum: e9bdaad2d37872820a4cad8e8dbde536
http://www.vmware.com/download/download.do?downloadGroup=ESX350U3
ESX Server 3.5 upgrade package from ESX Server 2.x to ESX Server 3.5
Update 3 Refresh
md5sum:2da08fed15bd4b1ed5b19433e837591c
http://www.vmware.com/download/download.do?downloadGroup=ESX350U3
ESX Server 3.5 upgrade package from ESX Server 3.0.x to ESX Server 3.5
Update 3 Refresh
md5sum:d631aa8418d99fce4280fc3905ac4c37
http://www.vmware.com/download/download.do?downloadGroup=ESX350U3
ESX Server 3.5 upgrade package from ESX Server 3.5 to ESX Server 3.5
Update 3 Refresh
md5sum:4dea5d943d0c0469c397b6520dfeb0fb
http://www.vmware.com/download/download.do?downloadGroup=ESX350U3
ESX 3.5 patch ESX350-200810201-UG (vCPU/directory traversal)
http://download3.vmware.com/software/vi/ESX350-200810201-UG.zip
md5sum: 6f26f985d9fea520ebdda7c65b60486e
http://kb.vmware.com/kb/1007041
ESX 3.0.3 patch ESX303-200810501-BG (vCPU)
http://download3.vmware.com/software/vi/ESX303-200810501-BG.zip
md5sum: da72f475c5ac038379d712d36307e33d
http://kb.vmware.com/kb/1006969
ESX 3.0.2 patch ESX-1006680 (vCPU)
http://download3.vmware.com/software/vi/ESX-1006680.tgz
md5sum: 8186a2e77bc7c0e4cd5b214d0a5d29c0
http://kb.vmware.com/kb/1006680
VMware ESX 2.5.5 Upgrade Patch 10
http://download3.vmware.com/software/esx/esx-2.5.5-119702-upgrade.tar.gz
md5sum: 2ee87cdd70b1ba84751e24c0bd8b4621
http://vmware.com/support/esx25/doc/esx-255-200810-patch.HTML
VMware ESX 2.5.4 Upgrade Patch 21
http://download3.vmware.com/software/esx/esx-2.5.4-119703-upgrade.tar.gz
md5sum: d791be525c604c852a03dd7df0eabf35
http://vmware.com/support/esx25/doc/esx-254-200810-patch.HTML
参考网址
来源: XF
名称: vmware-cpuhardware-priv-escalation(46415)
链接:http://xforce.iss.net/xforce/xfdb/46415
来源:www.vmware.com
链接:http://www.vmware.com/security/advisories/VMSA-2008-0018.HTML
来源: SECTRACK
名称: 1021154
链接:http://www.securitytracker.com/id?1021154
来源: BID
名称: 32168
链接:http://www.securityfocus.com/bid/32168
来源: BUGTRAQ
名称: 20081107 VMSA-2008-0018 VMware Hosted products and patches for ESX and ESXi resolve two security issues
链接:http://www.securityfocus.com/archive/1/archive/1/498138/100/0/threaded
来源: VUPEN
名称: ADV-2008-3052
链接:http://www.frsirt.com/english/advisories/2008/3052
来源: SECUNIA
名称: 32624
链接:http://secunia.com/advisories/32624
来源: SECUNIA
名称: 32612
链接:http://secunia.com/advisories/32612
来源: MLIST
名称: [Security-announce] 20081106 VMSA-2008-0018 VMware Hosted products and patches for ESX and ESXi resolve two security issues
链接:http://lists.vmware.com/pipermail/security-announce/2008/000042.HTML
受影响实体
- Vmware Esx:2.5.4
- Vmware Esx:2.5.5
- Vmware Esx:3.5
- Vmware Player:1.0.4
- Vmware Player:1.0.3
补丁
暂无
![weinxin](http://zone.ci/zone_ci_images/zone.ci.png)
评论