USN-6463-2: Open VM Tools vulnerabilities

Releases

• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• open-vm-tools - Open VMware Tools for virtual machines hosted on VMware

Details

USN-6463-1 fixed vulnerabilities in Open VM Tools. This update provides
the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that Open VM Tools incorrectly handled SAML tokens. A
remote attacker with Guest Operations privileges could possibly use this
issue to elevate their privileges. (CVE-2023-34058)

Matthias Gerstner discovered that Open VM Tools incorrectly handled file
descriptors when dropping privileges. A local attacker could possibly use
this issue to hijack /dev/uinput and simulate user inputs. (CVE-2023-34059)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• open-vm-tools - 2:11.0.5-4ubuntu0.18.04.3+esm3
  Available with Ubuntu Pro
• open-vm-tools-desktop - 2:11.0.5-4ubuntu0.18.04.3+esm3
  Available with Ubuntu Pro

Ubuntu 16.04

• open-vm-tools - 2:10.2.0-3~ubuntu0.16.04.1+esm4
  Available with Ubuntu Pro
• open-vm-tools-desktop - 2:10.2.0-3~ubuntu0.16.04.1+esm4
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-34058
• CVE-2023-34059

Related notices

• USN-6463-1: open-vm-tools-sdmp, open-vm-tools-salt-minion, open-vm-tools-dev, open-vm-tools, open-vm-tools-containerinfo, open-vm-tools-desktop