full-disclosure - TPTI-09-01: VMWare VMnc Codec Invalid RFB Message Type Heap Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <C5FFD3BB.1611B%dvlabs@tippingpoint.com>
Date: Mon, 6 Apr 2009 15:43:55 -0500
From: dvlabs <dvlabs@...pingpoint.com>
To: FD <full-disclosure@...ts.grok.org.uk>, bugtraq <bugtraq@...urityfocus.com>
Cc: dvlabs <dvlabs@...pingpoint.com>
Subject: TPTI-09-01: VMWare VMnc Codec Invalid RFB Message
	Type Heap Overflow

TPTI-09-01: VMWare VMnc Codec Invalid RFB Message Type Heap Overflow
Vulnerability
http://dvlabs.tippingpoint.com/advisory/TPTI-09-01
April 6, 2009

-- CVE ID:
CVE-2009-0909

-- Affected Vendors:
VMWare, Inc.

-- Affected Products:
VMWare, Inc. VMWare Player
VMWare, Inc. VMWare Workstation
VMWare, Inc. VMWare Server
VMWare, Inc. VMWare ACE

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of multiple VMWare products. User interaction
is required in that a user must visit a malicious web page or open a
malicious video file.

Upon installation VMWare Workstation, Server, Player, and ACE register
vmnc.dll as a video codec driver to handle compression and decompression
of the fourCC type 'VMnc'. This format is used primarily by Workstation
to capture remote framebuffer recordings of sessions within a virtual
machine. The resulting video is essentially a recorded session of VNC's
RFB protocol. In VMWare's implementation the stream consists solely of
FrameBufferUpdate messages (message type 0). However, if the message
type of one of these blocks is changed to any value greater than 0x03 a
size assumption is made which results in faulty math being applied to a
pointer used later in a memcpy.  This can be leveraged to execute
arbitrary code on the host system under the context of the current user.

-- Vendor Response:
VMWare, Inc. has issued an update to correct this vulnerability. More
details can be found at:

http://www.vmware.com/security/advisories/VMSA-2009-0005.html

-- Disclosure Timeline:
2009-02-13 - Vulnerability reported to vendor
2009-04-06 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by:
    * Aaron Portnoy, TippingPoint DVLabs

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/