[USN-6257-1] Open VM Tools vulnerability

[Nishit Majithia]

==========================================================================
Ubuntu Security Notice USN-6257-1
July 27, 2023

open-vm-tools vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

open-vm-tools could be made to bypass authentication.

Software Description:
- open-vm-tools: Open VMware Tools for virtual machines hosted on VMware

Details:

It was discovered that Open VM Tools incorrectly handled certain
authentication requests. A fully compromised ESXi host can force Open VM
Tools to fail to authenticate host-to-guest operations, impacting the
confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
  open-vm-tools                   2:12.1.5-3ubuntu0.23.04.1

Ubuntu 22.04 LTS:
  open-vm-tools                   2:12.1.5-3~ubuntu0.22.04.2

Ubuntu 20.04 LTS:
  open-vm-tools                   2:11.3.0-2ubuntu0~ubuntu20.04.5

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  open-vm-tools                   2:11.0.5-4ubuntu0.18.04.3+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  open-vm-tools                   2:10.2.0-3~ubuntu0.16.04.1+esm2

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6257-1
  CVE-2023-20867

Package Information:
  https://launchpad.net/ubuntu/+source/open-vm-tools/2:12.1.5-3ubuntu0.23.04.1
  https://launchpad.net/ubuntu/+source/open-vm-tools/2:12.1.5-3~ubuntu0.22.04.2
  https://launchpad.net/ubuntu/+source/open-vm-tools/2:11.3.0-2ubuntu0~ubuntu20.04.5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230727/d57aeb35/attachment.sig>