Gerardo Richarte has reported a vulnerability in VMware products, which can be exploited by malicious, local users or malicious applications to bypass certain security restrictions.

The vulnerability is caused due to an input validation error when handling pathnames within a shared folder in a guest OS. This can be exploited to e.g. read or write arbitrary files on the host OS via directory traversal attacks.

This is reportedly related to #5 in:
SA25079

Successful exploitation requires that the shared folders feature is enabled with at least one folder configured for sharing between host and guest.

The vulnerability affects the following products and versions on Windows:
* VMware Workstation 6.0.2 and earlier
* VMware Workstation 5.5.4 and earlier
* VMware Player 2.0.2 and earlier
* VMware Player 1.0.4 and earlier
* VMware ACE 2.0.2 and earlier
* VMware ACE 1.0.2 and earlier
* VMware Server prior to 1.0.5

Solution
VMware Player:
Further details available to Secunia VIM customers

Provided and/or discovered by
Gerardo Richarte, Core Security Technologies.

Changelog
Further details available to Secunia VIM customers

Original Advisory
VMware:
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004034
http://www.vmware.com/support/player2/doc/releasenotes_player2.html
http://www.vmware.com/support/server/doc/releasenotes_server.html
http://www.vmware.com/security/advisories/VMSA-2008-0005.html

CORE-2007-0930 (via Full-Disclosure):
http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060457.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers