A new major security issue was found and communicated to VMware before posting on SecurityFocus (as ethical bug hunting should always be).
The flaw permits a malicious guest OS configured to use VMware NAT networking (VMnet8) to execute arbitrary code on host OS.
VMware products afflicted are Workstation 5.5, GSX Server 3.2, ACE 1.0.1 and Player 1.0.0.
To track the issue monitor the related VMware Knowledge Base article.
While the VMware Player is just released as 1.0.1 to fix the vulnerability, VMware still expected to release updated bits for Workstation, GSX and ACE.
Meanwhile you should disable the VMware NAT networking device as explained in this VMware Knowledge Base article.
Update: All afflicted products are now updated:
- Workstation 5.5.1 (b19175)
- GSX Server 3.2.1 (b19281)
- ACE 1.0.2 (b19206)
All of them are available for downloading here.