Real risk for VMware users
By Matthew Sparkes
Posted on 26 Feb 2008 at 11:24
VMware users running shared folders could be vulnerable to hackers and viruses, warn security researchers.
By using certain strings in a pathname, which VMware fails to filter out, a malicious hacker can access the whole file system of the host computer.
The flaw means that a user running on a guest system could gain access to the host computer, and therefore any sensitive files stored on it.
Malicious code, including viruses and Trojans could use the same exploit, leaving devices previously thought immune from attack vulnerable.
"This discovery demonstrates that thousands of companies with virtualised systems could unknowingly be exposing critical information assets that they otherwise sought to protect," warns a statement from Core Security Technologies, which revealed the security flaw.
The company has also released an exploit for the flaw, "enabling customers to validate that it exists, prove that can be exploited, and safely assess the consequences of an actual network intrusion."
The exploit only works on VMware Workstation 6.0.2 and earlier, Player 2.0.2 and earlier and ACE 2.0.2 and earlier. VMware Server is not affected, because it does not use shared folders.
VMware has acknowledged the security vulnerability, and says that a fix is under development.
"Until VMware releases a patch to fix this issue, users of affected Windows-hosted VMware products should disable shared folders," says a VMware advisory.
From around the web
advertisement
- Laptop bag reviews: nine tested
- Sony VAIO T Series Ultrabook review: first look
- Revealed: the military standards and robots HP uses to test its laptops
- Windows 8: multi-monitors and double standards?
- Why is TalkTalk's year-old porn filter suddenly big news?
- Why are laptop screens so far behind mobiles?
- HP EliteBook Folio review: first look
- The shoebox-sized all-in-one printer
- Forget the Ultrabook: here comes the HP Sleekbook
- HP Spectre XT review: first look
- Why you have to be left in the dark on OS patches
- Is Microsoft mismanaging Windows on ARM?
- Dealing with spam surrogates
- Why 3G broadband can be better and cheaper than ADSL
- Is Twitter bad for business?
- Publishing your email address isn't a security disaster
- Why you'll need a fax machine to develop iOS apps
- Learning to adapt to the mobile web
- Why you shouldn't use WPS on your Wi-Fi network
- Disabled users suffer when software breaks the rules
advertisement
