Symlink Attack Vulnerability in open-vm-tools: Local Access Bypass
Summary
DEBIAN-CVE-2009-1143: An issue was discovered in open-vm-tools 2009.03.18-154848. Affects open-vm-tools versions < 2:12.0.0-1. Fixed in 2:12.0.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
open-vm-tools is a suite of open-source tools that enhance the performance and usability of virtual machines running on VMware platforms. It provides functionalities such as improved mouse integration, shared folders, and better management of virtual machines. However, a vulnerability has been identified that allows local users to bypass access restrictions when mounting shares, potentially leading to unauthorized access to sensitive data.
Vulnerability Detail
An issue was discovered in open-vm-tools version 2009.03.18-154848, where local users can exploit a symlink attack due to a realpath race condition in the mount.vmhgfs (hgfsmounter) utility. This vulnerability allows unauthorized access to mounted shares, which could lead to data exposure or manipulation. The flaw arises from improper handling of symlinks, enabling attackers to create malicious links that the system may inadvertently follow, thus bypassing intended security measures.
How To Fix
Minimum fixed version
2:12.0.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade open-vm-toolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict local user access to the mount.vmhgfs utility or implement stricter permissions on shared directories to mitigate the risk of exploitation until the package is updated.
Conclusion
The identified vulnerability in open-vm-tools poses a significant risk by allowing local users to bypass access restrictions through a symlink attack. It is crucial for users to update to the patched version to mitigate this risk. Additionally, implementing temporary workarounds can help protect sensitive data until the update is applied.
See every vulnerability recorded for open-vm-tools →
FAQ
The vulnerability allows local users to bypass access restrictions on mounting shares through a symlink attack, exploiting a race condition in the mount.vmhgfs utility.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability could lead to unauthorized access to sensitive data stored in shared directories, potentially compromising system security.
Yes, a patched version of open-vm-tools (2:12.0.0-1) is available. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, consider restricting access to the mount.vmhgfs utility and applying stricter permissions on shared directories as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-vm-tools.
