Date: Wed, 26 Oct 2016 04:47:48 +0000
From: VMware Security Response Center <security@...are.com>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
 "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
 "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: [FD] New VMSA-2016-0017 - VMware product updates address multiple
 information disclosure issues


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
                   VMware Security Advisory

Advisory ID: VMSA-2016-0017
Severity:    Moderate
Synopsis:    VMware product updates address multiple information
             disclosure issues
Issue date:  2016-10-25
Updated on:  2016-10-25 (Initial Advisory)
CVE number:  CVE-2016-5328, CVE-2016-5329

1. Summary

VMware product updates address information disclosure issues in
VMware Fusion and VMware Tools running on Mac OS X.

2. Relevant Products

    VMware Fusion
    VMware Tools

3. Problem Description

a. VMware Tools Information disclosure issue in Mac OS X Virtual Machines

An information disclosure vulnerability is present in VMware Tools
running on Mac OS X VMs. Successful exploitation of this issue may
allow a privileged local user on a system where System Integrity Protection
(SIP) is enabled, to obtain kernel memory addresses to bypass the kASLR
protection mechanism. SIP is default enabled in the latest versions of Mac
OS X.

There are no known workarounds for this issue.

VMware would like to thank Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned
the identifier CVE-2016-5328 to this issue.

Column 5 of the following table lists the action required to remediate the
vulnerability in each release, if a solution is available.

   VMware          Product    Running                  Replace with/
   Product         Version    on          Severity     Apply Patch**
Workaround
   ============    =======    =======     ========     =============
==========
   VMware Tools    9.x,10.x   Window        N/A          not affected
None
   VMware Tools    9.x,10.x   Linux         N/A          not affected
None
   VMware Tools    9.x,10.x   Mac OS X    Moderate       10.1.0*
None

   * VMware Tools 10.1.0 can be downloaded independently and installed to
     resolve this issue.

   ** At the moment, no versions of ESXi and Fusion consume the latest
      version of VMware Tools i.e. 10.1.0. Remediation of this issue on
  ESXi and Fusion requires downloading and installation of VMware Tools
  10.1.0.

b. VMware Fusion Information disclosure

An information disclosure vulnerability is present in VMware Fusion.
Successful exploitation of this issue may allow a privileged local user
on a system where System Integrity Protection (SIP) is enabled, to obtain
kernel memory addresses to bypass the kASLR protection mechanism. SIP is
default enabled in the latest versions of Mac OS X.

There are no known workarounds for this issue.

VMware would like to thank Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the identifier CVE-2016-5329 to this issue.

Column 5 of the following table lists the action required to remediate the
vulnerability in each release, if a solution is available.

   VMware             Product   Running                  Replace with/
   Product            Version   on          Severity     Apply Patch
Workaround
   ===============    =======   =======     ========     =============
==========
   VMware Fusion       8.x      Mac OS X    Moderate        8.5
None

4. Solution

Please review the patch/release notes for your product and version and
verify the checksum of your downloaded file.

VMware Fusion 8.5
- - -----------------------------
Downloads and Documentation:
https://www.vmware.com/go/downloadfusion

VMware Tools 10.1.0
- - ------------------------------
Downloads:
https://my.vmware.com/web/vmware/details?downloadGroup=VMTOOLS1010&productI
d=491
Documentation:
http://pubs.vmware.com/Release_Notes/en/vmwaretools/1010/vmware-tools-1010-
release-notes.html


5. References

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5328
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5329

6. Change log

   2016-10-25 VMSA-2016-0017 Initial security advisory in conjunction with
   the release of VMware Tools 10.1.0 on 2016-10-25.

7. Contact

   E-mail list for product security notifications and announcements:
   http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

   This Security Advisory is posted to the following lists:
   security-announce@...ts.vmware.com
   bugtraq@...urityfocus.com
   fulldisclosure@...lists.org

   E-mail: security@...are.com
   PGP key at: https://kb.vmware.com/kb/1055

   VMware Security Advisories
   http://www.vmware.com/security/advisories

   Consolidated list of VMware Security Advisories
   http://kb.vmware.com/kb/2078735

   VMware Security Response Policy
   https://www.vmware.com/support/policies/security_response.html

   VMware Lifecycle Support Phases
   https://www.vmware.com/support/policies/lifecycle.html

   Twitter
   https://twitter.com/VMwareSRC


   Copyright 2016 VMware Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: Encryption Desktop 10.3.2 (Build 21165)
Charset: utf-8

wj8DBQFYEDBSDEcm8Vbi9kMRAuPfAKC5RBI+0P/ayy1hqsQYizu0T/55FQCghX68
sbgyxgU/FYYr554HQ+4Otqw=
=47f/
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists