Open-vm-tools Security Update: SAML Token Signature Bypass and File Descriptor Hijack Vulnerability
Summary
ALSA-2023:7265: Important: open-vm-tools security update. Affects open-vm-tools versions < 12.2.5-3.el8_9.1.alma.1. Fixed in 12.2.5-3.el8_9.1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open-vm-tools is the open source implementation of VMware Tools, providing guest operating system virtualization components that enhance performance and user experience of virtual machines. It is widely used in virtualized environments to optimize the interaction between the host and guest systems.
Vulnerability Detail
This security update addresses two vulnerabilities in open-vm-tools:
-
SAML Token Signature Bypass (CVE-2023-34058): This vulnerability allows an attacker to bypass the signature verification of SAML tokens, potentially leading to unauthorized access or privilege escalation.
-
File Descriptor Hijack Vulnerability in vmware-user-suid-wrapper (CVE-2023-34059): This vulnerability enables an attacker to hijack file descriptors in the vmware-user-suid-wrapper, potentially leading to arbitrary file access or other malicious actions.
How To Fix
Minimum fixed version
12.2.5-3.el8_9.1.alma.1
This is the first release that contains the fix.
sudo dnf update open-vm-toolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Open-vm-tools has released a security update to address two vulnerabilities: SAML token signature bypass and file descriptor hijack. It is crucial to update open-vm-tools to the recommended version to mitigate the risk of unauthorized access, privilege escalation, or arbitrary file access. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for open-vm-tools →
FAQ
Open-vm-tools is the open source implementation of VMware Tools, providing guest operating system virtualization components that enhance performance and user experience of virtual machines.
The SAML token signature bypass vulnerability can allow an attacker to bypass the signature verification of SAML tokens, potentially leading to unauthorized access or privilege escalation.
The file descriptor hijack vulnerability in vmware-user-suid-wrapper can enable an attacker to hijack file descriptors, potentially leading to arbitrary file access or other malicious actions.
To fix these vulnerabilities, update open-vm-tools to version 12.2.5-3.el8_9.1.alma.1 or later. Follow the provided steps in the 'how_to_fix' section.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for open-vm-tools.
