July 28, 2014

VMWare ESX Source Code Stolen – Starts to Leak onto Internet

(LiveHacking.Com) – VMware has confirmed that the source code for its ESX hypervisor has been stolen and portions of it are starting to appear on the Internet. Iain Mulholland, the Director of the VMware Security Response Center, wrote that they are “aware of the public posting of a single file from the VMware ESX source code and the possibility that more files may be posted in the future. The posted code and associated commentary dates to the 2003 to 2004 timeframe.”

The hacker, named Hardcore Charlie, is claiming that the code was stolen from the military contractor China National Import & Export Corp (CEIEC), however they are reporting that such claims are “totally groundless, highly subjective and defamatory.”

“The fact that the source code may have been publicly shared does not necessarily mean that there is any increased risk to VMware customers,” added Iain Mulholland. In the same blog post VMware acknowldged that it shares its source code and interfaces with others companies. Which seems to lend credence to Hardcore Charlie’s claims about the CEIEC breach.

The header file (vmkemit.h) posted by the hacker carries a 1998 copyright date stamp and lists a set of code emission macros for base x86 architecture used by vmkernel.

Hardcore Charlie published the code in a rather incoherent posting to pastebin that also talks about alleged collusion between CITEC and Western military and terrorist organisations: “we want to make it clear that CEIEC is engaged in a criminal activity with Ukraine and Russian officials as of supplying Ukraine and Russia with US army information for the terrorists.” 

The hacker has also threatened to release the source code for EMC.

Patch Roundup: Java, Flash, VLC, VMware, Chrome

The last few days has seen patches released for several major software packages including Java and Flash.

Java
Oracle has released patches to address several critical vulnerabilities in Java. Nine of the seventeen vulnerabilities have the highest severity rating. Affected versions are the Java Development Kit (JDK) and the Java Runtime Environment (JRE) versions 6.0 (up to and including update 25), version 5.0 (up to and including update 29) and version 1.4.2 (up to and including version 1.4.2_31) across all supported platforms.

According to the update advisory, “all of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.”

VMware
VMware has released security advisory VMSA-2011-0009 to address multiple vulnerabilities in the following products:

  • VMware Workstation 7.1.3 and earlier
  • VMware Player 3.1.3 and earlier
  • VMware Fusion 3.1.2 and earlier
  • ESXi 4.1 without patch ESXi410-201104402-BG
  • ESXi 4.0 without patch ESXi400-201104402-BG
  • ESXi 3.5 without patches ESXe350-201105401-I-SG and ESXe350-201105402-T-SG
  • ESX 4.1 without patch ESX410-201104401-SG
  • ESX 4.0 without patch ESX400-201104401-SG
  • ESX 3.5 without patches ESX350-201105401-SG, ESX350-201105404-SG, and ESX350-201105406-SG

VLC
VideoLAN has released VLC Media Player 1.1.10 to address an integer overflow vulnerability in the xspf demuxer. Exploitation of this vulnerability may allow an attacker to execute arbitrary code. The release notes also mention that libmodplug has been updated for security reasons in the Windows and Mac versions.

Flash
Adobe has released the security bulletin APSB11-13 to address a vulnerability in Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux, and Solaris, and 10.3.185.22 and earlier versions for Android.

The universal cross-site scripting vulnerability (CVE-2011-2107) could be used to take actions on a user’s behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message.

Adobe recommends users of Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris update to Adobe Flash Player 10.3.181.22 (10.3.181.23 for ActiveX). Adobe recommends users of Adobe Flash Player 10.3.185.22 and earlier versions for Android update to Adobe Flash Player 10.3.181.23.

And Chrome

Google has released Chrome 12 with several security fixes:

  • [$2000] [73962] [79746] High CVE-2011-1808: Use-after-free due to integer issues in float handling. Credit to miaubiz.
  • [75496] Medium CVE-2011-1809: Use-after-free in accessibility support. Credit to Google Chrome Security Team (SkyLined).
  • [75643] Low CVE-2011-1810: Visit history information leak in CSS. Credit to Jesse Mohrland of Microsoft and Microsoft Vulnerability Research (MSVR).
  • [76034] Low CVE-2011-1811: Browser crash with lots of form submissions. Credit to “DimitrisV22”.
  • [$1337] [77026] Medium CVE-2011-1812: Extensions permission bypass. Credit to kuzzcc.
  • [78516] High CVE-2011-1813: Stale pointer in extension framework. Credit to Google Chrome Security Team (Inferno).
  • [79362] Medium CVE-2011-1814: Read from uninitialized pointer. Credit to Eric Roman of the Chromium development community.
  • [79862] Low CVE-2011-1815: Extension script injection into new tab page. Credit to kuzzcc.
  • [80358] Medium CVE-2011-1816: Use-after-free in developer tools. Credit to kuzzcc.
  • [$500] [81916] Medium CVE-2011-1817: Browser memory corruption in history deletion. Credit to Collin Payne.
  • [$1000] [81949] High CVE-2011-1818: Use-after-free in image loader. Credit to miaubiz.
  • [$1000] [83010] Medium CVE-2011-1819: Extension injection into chrome:// pages. Credit to Vladislavas Jarmalis, plus subsequent independent discovery by Sergey Glazunov.
  • [$3133.7] [83275] High CVE-2011-2332: Same origin bypass in v8. Credit to Sergey Glazunov.
  • [$1000] [83743] High CVE-2011-2342: Same origin bypass in DOM. Credit to Sergey Glazunov.

Note that the referenced bugs may be kept private until a majority of Chrome users have updated.

Chrome 12.0.742.91 also includes a number of new features including:

  • Hardware accelerated 3D CSS
  • New Safe Browsing protection against downloading malicious files
  • Ability to delete Flash cookies from inside Chrome
  • Launch Apps by name from the Omnibox
  • Integrated Sync into new settings pages
  • Improved screen reader support
  • New warning when hitting Command-Q on Mac
  • Removal of Google Gears

Microsoft’s Patch Tuesday Updates Break VMware on Windows 7

It turns out that last week’s patch Tuesday update from Microsoft broke some bits of VMware on Windows 7, fortunatley VMware have responded quickly with an update to their software.

If you have installed updates 2482017 or 2467023 (which you most likely have if you have automatic updates enabled on your Windows 7 machine) and expericnce the problem below you will need to upgraded your VMware View Client:

  • Unable to connect from the View Client on Windows 7 to the View Connection Server
  • Connecting the View Client on Windows 7 to the View Connection Server fails

According to the VMware knowledge base if you have already installed these patches, you can install VMware View Client (build 353760) to resolved the problem.

If you have not installed these patches, delay the installation of the Microsoft patches until you have installed VMware View Client (build 353760).

The View Client patch can be downloaded from here.