USN-6463-1: Open VM Tools vulnerabilities

Q: How can the vulnerability be exploited?

A remote attacker with Guest Operations privileges could possibly use this issue to escalate privileges.

Q: How can I fix the vulnerability?

Update to version 2:12.3.0-1ubuntu0.1 of open-vm-tools package.

Q: Where can I find more information about the vulnerability?

You can find more information about the vulnerability at the following references: CVE-2023-34059, CVE-2023-34058, and the Ubuntu security advisory.

Published Oct 31, 2023

Updated

It was discovered that Open VM Tools incorrectly handled SAML tokens. A remote attacker Guest Operations privileges could possibly use this issue to escalate privileges. (CVE-2023-34058) Matthias Gerstner discovered that Open VM Tools incorrectly handled file descriptors when dropping privileges. A local attacker could possibly use this issue to hijack /dev/uinput and simulate user inputs. (CVE-2023-34059)

Affected Software

16 affected componentsFixes available

All of the following

ubuntu/open-vm-tools<2:12.3.0-1ubuntu0.1

2:12.3.0-1ubuntu0.1

Ubuntu Ubuntu=23.10

All of the following

ubuntu/open-vm-tools-desktop<2:12.3.0-1ubuntu0.1

2:12.3.0-1ubuntu0.1

Ubuntu Ubuntu=23.10

All of the following

ubuntu/open-vm-tools<2:12.1.5-3ubuntu0.23.04.3

2:12.1.5-3ubuntu0.23.04.3

Ubuntu Ubuntu=23.04

All of the following

ubuntu/open-vm-tools-desktop<2:12.1.5-3ubuntu0.23.04.3

2:12.1.5-3ubuntu0.23.04.3

Ubuntu Ubuntu=23.04

All of the following

ubuntu/open-vm-tools<2:12.1.5-3~ubuntu0.22.04.4

2:12.1.5-3~ubuntu0.22.04.4

Ubuntu Ubuntu=22.04

All of the following

ubuntu/open-vm-tools-desktop<2:12.1.5-3~ubuntu0.22.04.4

2:12.1.5-3~ubuntu0.22.04.4

Ubuntu Ubuntu=22.04

All of the following

ubuntu/open-vm-tools<2:11.3.0-2ubuntu0~ubuntu20.04.7

2:11.3.0-2ubuntu0~ubuntu20.04.7

Ubuntu Ubuntu=20.04

All of the following

ubuntu/open-vm-tools-desktop<2:11.3.0-2ubuntu0~ubuntu20.04.7

2:11.3.0-2ubuntu0~ubuntu20.04.7

Ubuntu Ubuntu=20.04

Event History

Oct 31, 2023

Advisory Published

via Ubuntu·12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID?

CVE-2023-34058

What software is affected by the vulnerability?

Open VM Tools

How can the vulnerability be exploited?

A remote attacker with Guest Operations privileges could possibly use this issue to escalate privileges.

How can I fix the vulnerability?

Update to version 2:12.3.0-1ubuntu0.1 of open-vm-tools package.

Where can I find more information about the vulnerability?

You can find more information about the vulnerability at the following references: CVE-2023-34059, CVE-2023-34058, and the Ubuntu security advisory.

USN-6463-1: Open VM Tools vulnerabilities

Affected Software

Event History

Child vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the vulnerability ID?

What software is affected by the vulnerability?

How can the vulnerability be exploited?

How can I fix the vulnerability?

Where can I find more information about the vulnerability?

Company

Resources

Contact