Blog Posts

It seems that the latest beta update of Workstation 6.5 is now available for download!

Also, this release no longer forces the debug-code and it will expire at the end of October (so the final bits are for sure almost ready).

Posted by Gabriel Maciel

This is kind of new (6.5 beta build 91182), so I wanted to write about how important it will be for any IT professional / enthusiast to have the ability to run ESX 3.5 / ESX 3i in VMware Workstation 6.5 when the final release is ready.

You see, this will not only be good because it could potentially give you the chance to test patches or scripts, but also because it allows you to "learn" about the environment without having to spend a lot of money.

We all know that VMware's licensing is not cheap, nor is the hardware to run the VI3 environment, and that is why I believe VMware should always try to "facilitate" the usage and testing of all its products without having to purchase expensive equipment.

Consequently, having now and in the future the chance to run ESX 3.5 / ESX 3i in VMware Workstation 6.5 is a very welcomed opportunity to experience one of the best virtualization products we have seen so far!

More information and print screens here and here.

Posted by Gabriel Maciel

VMware Server Version 1.0.5 (free) / http://www.vmware.com/download/server

• A security vulnerability in OpenSSL 0.9.7j could make it possible to forge a RSA key signature. VMware Server 1.0.5 upgrades OpenSSL to version 0.9.7l to avoid this vulnerability.
• An internal security audit determined that a malicious user could attain and exploit LocalSystem privileges by causing the authd process to connect to a named pipe that is opened and controlled by the
• malicious user. In this situation, the malicious user could successfully impersonate authd and attain privileges under which authd is executing.
• An internal security audit determined that a malicious user could exploit an insecurely created named pipe object to escalate priviliges or create a denial-of-service attack.
• This release updates the libpng library to version 1.2.22 to remove various security vulnerabilities.
• A vulnerability in VMware Workstation running on Windows allowed complete access to the host's file system from a guest machine. This access included the ability to create and modify executable files in
  sensitive locations.
• The authd process read and honored the vmx.fullpath variable in the user-writable file config.ini, creating a security vulnerability.
• The config.ini file could be modified by non-administrator to change the VMX launch path. This created a vulnerability that could be exploited to escalate a user's privileges.

• On Windows hosts, if you have configured and enabled a shared folder, it is possible for an attacker to write arbitrary content from a guest system to arbitrary locations on the host system.
• An internal security audit determined that a malicious user could attain and exploit LocalSystem privileges by causing the authd process to connect to a named pipe that is opened and controlled by the malicious user. In this situation, the malicious user could successfully impersonate authd and attain privileges under which Authd is executing.
• This release updates the libpng library to version 1.2.22 to remove various security vulnerabilities.
• This release updates the OpenSSL library to address various vulnerabilities to denial-of-service attacks and buffer overflows.
• Workstation 6.0.2 allowed anonymous console access to the guest by means of the VIX API. This release, Workstation 6.0.3, disables this feature. This means that the Eclipse Integrated Virtual Debugger and the Visual Studio Integrated Virtual Debugger will now prompt for user account credentials to access a guest.

• On Windows hosts, if you have configured and enabled a shared folder, it is possible for an attacker to write arbitrary content from a guest system to arbitrary locations on the host system.
• Ubuntu 7.04 virtual machines sometimes power off unexpectedly if paravirtual kernel support is enabled.

• Release Notes: http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html#new_203

• http://www.vmware.com/beta/server