SUSE update for open-vm-tools
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-34058 CVE-2023-34059 |
| CWE-ID | CWE-285 CWE-284 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Micro Operating systems & Components / Operating system openSUSE Leap Micro Operating systems & Components / Operating system Desktop Applications Module Operating systems & Components / Operating system Basesystem Module Operating systems & Components / Operating system SUSE Linux Enterprise Micro for Rancher Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP3 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing LTSS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing ESPOS 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system open-vm-tools-salt-minion Operating systems & Components / Operating system package or component open-vm-tools-containerinfo Operating systems & Components / Operating system package or component open-vm-tools-debuginfo Operating systems & Components / Operating system package or component libvmtools0 Operating systems & Components / Operating system package or component open-vm-tools-debugsource Operating systems & Components / Operating system package or component libvmtools0-debuginfo Operating systems & Components / Operating system package or component open-vm-tools-sdmp Operating systems & Components / Operating system package or component open-vm-tools-desktop-debuginfo Operating systems & Components / Operating system package or component open-vm-tools-sdmp-debuginfo Operating systems & Components / Operating system package or component libvmtools-devel Operating systems & Components / Operating system package or component open-vm-tools-desktop Operating systems & Components / Operating system package or component open-vm-tools Operating systems & Components / Operating system package or component open-vm-tools-containerinfo-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Improper Authorization
EUVDB-ID: #VU82520
Risk: Medium
CVSSv4.0: 5.2 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-34058
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to an error when handling SAML token signature. A remote attacker that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias.
Update the affected package open-vm-tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.1 - 5.5
openSUSE Leap Micro: 5.3 - 5.4
Desktop Applications Module: 15-SP4 - 15-SP5
Basesystem Module: 15-SP4 - 15-SP5
SUSE Linux Enterprise Micro for Rancher: 5.2 - 5.4
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP5
SUSE Linux Enterprise Server 15: SP3 - SP5
SUSE Linux Enterprise Real Time 15: SP4 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP5
SUSE Linux Enterprise Desktop 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP3 LTSS: 15-SP3
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP3
openSUSE Leap: 15.3 - 15.5
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.2 - 4.3
SUSE Manager Server: 4.2 - 4.3
SUSE Manager Proxy: 4.2 - 4.3
open-vm-tools-salt-minion: before 12.3.0-150300.43.1
open-vm-tools-containerinfo: before 12.3.0-150300.43.1
open-vm-tools-debuginfo: before 12.3.0-150300.43.1
libvmtools0: before 12.3.0-150300.43.1
open-vm-tools-debugsource: before 12.3.0-150300.43.1
libvmtools0-debuginfo: before 12.3.0-150300.43.1
open-vm-tools-sdmp: before 12.3.0-150300.43.1
open-vm-tools-desktop-debuginfo: before 12.3.0-150300.43.1
open-vm-tools-sdmp-debuginfo: before 12.3.0-150300.43.1
libvmtools-devel: before 12.3.0-150300.43.1
open-vm-tools-desktop: before 12.3.0-150300.43.1
open-vm-tools: before 12.3.0-150300.43.1
open-vm-tools-containerinfo-debuginfo: before 12.3.0-150300.43.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap_micro:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap_micro:5.4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro_for_rancher:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3_ltss:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:open-vm-tools-salt-minion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-containerinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libvmtools0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libvmtools0-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-sdmp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-desktop-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-sdmp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libvmtools-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-desktop:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-containerinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20234227-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper access control
EUVDB-ID: #VU82560
Risk: Low
CVSSv4.0: 4.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-34059
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the vmware-user-suid-wrapper. A local attacker can hijack the /dev/uinput file descriptor allowing them to simulate user inputs.
MitigationUpdate the affected package open-vm-tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.1 - 5.5
openSUSE Leap Micro: 5.3 - 5.4
Desktop Applications Module: 15-SP4 - 15-SP5
Basesystem Module: 15-SP4 - 15-SP5
SUSE Linux Enterprise Micro for Rancher: 5.2 - 5.4
SUSE Linux Enterprise Server for SAP Applications 15: SP3 - SP5
SUSE Linux Enterprise Server 15: SP3 - SP5
SUSE Linux Enterprise Real Time 15: SP4 - SP5
SUSE Linux Enterprise High Performance Computing 15: SP3 - SP5
SUSE Linux Enterprise Desktop 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP3 LTSS: 15-SP3
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP3
openSUSE Leap: 15.3 - 15.5
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.2 - 4.3
SUSE Manager Server: 4.2 - 4.3
SUSE Manager Proxy: 4.2 - 4.3
open-vm-tools-salt-minion: before 12.3.0-150300.43.1
open-vm-tools-containerinfo: before 12.3.0-150300.43.1
open-vm-tools-debuginfo: before 12.3.0-150300.43.1
libvmtools0: before 12.3.0-150300.43.1
open-vm-tools-debugsource: before 12.3.0-150300.43.1
libvmtools0-debuginfo: before 12.3.0-150300.43.1
open-vm-tools-sdmp: before 12.3.0-150300.43.1
open-vm-tools-desktop-debuginfo: before 12.3.0-150300.43.1
open-vm-tools-sdmp-debuginfo: before 12.3.0-150300.43.1
libvmtools-devel: before 12.3.0-150300.43.1
open-vm-tools-desktop: before 12.3.0-150300.43.1
open-vm-tools: before 12.3.0-150300.43.1
open-vm-tools-containerinfo-debuginfo: before 12.3.0-150300.43.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap_micro:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap_micro:5.4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:desktop_applications_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro_for_rancher:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3_ltss:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:suse:open-vm-tools-salt-minion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-containerinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libvmtools0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libvmtools0-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-sdmp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-desktop-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-sdmp-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libvmtools-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-desktop:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:open-vm-tools-containerinfo-debuginfo:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20234227-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
