VMWare hosted products contain a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the HTTP server not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) appended to the /sdk path. This directory traversal attack would allow the attacker to read arbitrary files on the host, including guest virtual machines.

Currently, there are no known workarounds or upgrades to correct this issue. However, VMware has released a patch to address this vulnerability.

• Security Tracker: 1023088 1023089
• CVE ID: 2009-3733 (see also: NVD)
• Bugtraq ID: 36842
• Secunia Advisory ID: 37186
• Metasploit ID: 59440
• OVAL ID: 7822
• VUPEN Advisory: ADV-2009-3062
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2009-10/0275.html
  http://lists.vmware.com/pipermail/security-announce/2009/000069.html
• Generic Exploit URL: http://d2sec.com/products.htm
  http://fyrmassociates.com/tools/gueststealer-v1.1.pl
• Vendor Specific Advisory URL: http://www.vmware.com/security/advisories/VMSA-2009-0015.html
• Other Advisory URL: http://www.vupen.com/english/advisories/2009/3062

• Tony Flick - Fyrm Associates
• Justin Morehouse - Personal