PT-2009-1126 · Vmware+3 · Open-Vm-Tools+3

Thomas Biege · Published 2009-03-19 · Updated 2024-12-09 · CVE-2009-1143

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions open-vm-tools version 2009.03.18-154848

Description The issue is related to the mount.vmhgfs component of the open-vm-tools package, which incorrectly handles symbolic links before accessing a file. This can allow an attacker to access confidential data, compromise its integrity, and cause a denial of service. Local users can bypass intended access restrictions on mounting shares via a symlink attack that leverages a realpath race condition in mount.vmhgfs.

Recommendations For open-vm-tools version 2009.03.18-154848, consider disabling the mount.vmhgfs component until a patch is available to prevent exploitation via a symlink attack. Restrict access to the mount.vmhgfs component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2022-2597

ALT-PU-2023-5642

ALT-PU-2024-16632

BDU:2024-09868

CVE-2009-1143

Affected Products

Alt Linux

Astra Linux

Debian

Open-Vm-Tools

References · 41

• https://errata.altlinux.org/ALT-PU-2024-16632 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE47 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1143 · Security Note
• https://bugs.gentoo.org/264577 · Patch
• https://bdu.fstec.ru/vul/2024-09868 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1143 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1143 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-1108SE17MD · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40896 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22943 · Security Note
• https://errata.altlinux.org/ALT-PU-2022-2597 · Vendor Advisory
• https://ubuntu.com/security/CVE-2009-1143 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/720111 · Security Note
• https://bdu.fstec.ru/vul/2023-05064 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20867 · Security Note