Knowledge Base

The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides
 
Search the VMware Knowledge Base (KB)   View by Article ID
 

Security Response to XSec-06-05, "VMware 5.5.1 for Windows arbitrary partition table delete issue" (5965318)

Details

The security advisory XSec-06-05 states that a remote user could delete partition tables.  The article is found at http://ww.xsec.org/index.php?module=Releases&act=view&type=1&id=13.

Solution

As the author states, this exploit requires that Microsoft Windows is running with Administrator privilege and Internet Explorer is set to run unsafe ActiveX controls. 
 
There is no privilege escalation with this exploit because the browser calling the ActiveX control must be running as Administrator. The overall safety of a given ActiveX control must be considered not only in terms of the ActiveX control itself (VMware vielib.dll is no less safe than many other ActiveX controls installed on Windows sytems), but also in terms of the privileges of the process calling it and the trustworthiness of the code controlling that calling process.
 
To avoid malicious scripts that exploit ActiveX controls, do not enable unsafe ActiveX objects in your browser settings. As a best practice, do not browse untrusted Web sites as an Administrator.

Keywords

security; alertz; urlz; partition; com; object; exploit

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 0 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (4000 or fewer characters)
  • 0 Ratings
Actions
KB: