Executive Summary
Summary | |
---|---|
Title | VMware Workstation, Player, Fusion, ESXi and ESX patches address critical security issues |
Informations | |||
---|---|---|---|
Name | VMSA-2012-0009 | First vendor Publication | 2012-05-03 |
Vendor | VMware | Last vendor Modification | 2012-06-13 |
Severity (Vendor) | N/A | Revision | 2 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
a. VMware host memory overwrite vulnerability (data pointers) Due to a flaw in the handler function for RPC commands, it is possible to manipulate data pointers within the VMX process. This vulnerability may allow a guest user to crash the VMX process or potentially execute code on the host. Workaround - Configure virtual machines to use less than 4 GB of memory. Virtual machines that have less than 4GB of memory are not affected. OR - Disable VIX messages from each guest VM by editing the configuration file (.vmx) for the virtual machine as described in VMware Knowledge Base article 1714. Add the following line: isolation.tools.vixMessage.disable = "TRUE". Note: This workaround is not valid for Workstation 7.x and Fusion 3.x Mitigation - Do not allow untrusted users access to your virtual machines. Root or Administrator level permissions are not required to exploit this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-1516 to this issue. VMware would like to thank Derek Soeder of Ridgeway Internet Security, L.L.C. for reporting this issue to us. b. VMware host memory overwrite vulnerability (function pointers) Due to a flaw in the handler function for RPC commands, it is possible to manipulate function pointers within the VMX process. This vulnerability may allow a guest user to crash the VMX process or potentially execute code on the host. Workaround - None identified Mitigation - Do not allow untrusted users access to your virtual machines. Root or Administrator level permissions are not required to exploit this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-1517 to this issue. VMware would like to thank Derek Soeder of Ridgeway Internet Security, L.L.C. for reporting this issue to us. c. ESX NFS traffic parsing vulnerability Due to a flaw in the handling of NFS traffic, it is possible to overwrite memory. This vulnerability may allow a user with access to the network to execute code on the ESXi/ESX host without authentication. The issue is not present in cases where there is no NFS traffic. Workaround - None identified Mitigation - Connect only to trusted NFS servers - Segregate the NFS network - Harden your NFS server The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-2448 to this issue. d. VMware floppy device out-of-bounds memory write Due to a flaw in the virtual floppy configuration it is possible to perform an out-of-bounds memory write. This vulnerability may allow a guest user to crash the VMX process or potentially execute code on the host. Workaround - Remove the virtual floppy drive from the list of virtual IO devices. The VMware hardening guides recommend removing unused virtual IO devices in general. Mitigation - Do not allow untrusted root users in your virtual machines. Root or Administrator level permissions are required to exploit this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-2449 to this issue. e. VMware SCSI device unchecked memory write Due to a flaw in the SCSI device registration it is possible to perform an unchecked write into memory. This vulnerability may allow a guest user to crash the VMX process or potentially execute code on the host. Workaround - Remove the virtual SCSI controller from the list of virtual IO devices. The VMware hardening guides recommend removing unused virtual IO devices in general. Mitigation - Do not allow untrusted root users access to your virtual machines. Root or Administrator level permissions are required to exploit this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-2450 to this issue. |
Original Source
Url : http://www.vmware.com/security/advisories/VMSA-2012-0009.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:16810 | |||
Oval ID: | oval:org.mitre.oval:def:16810 | ||
Title: | VMware host memory overwrite vulnerability (data pointers) | ||
Description: | The VMX process in VMware ESXi 3.5 through 4.1 and ESX 3.5 through 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving data pointers. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1516 | Version: | 4 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | VMware Workstation VMware Player |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:16852 | |||
Oval ID: | oval:org.mitre.oval:def:16852 | ||
Title: | VMware SCSI device unchecked memory write | ||
Description: | VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2450 | Version: | 4 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | VMware Workstation VMware Player |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:16863 | |||
Oval ID: | oval:org.mitre.oval:def:16863 | ||
Title: | VMware Workstation, Player patches address security issues | ||
Description: | VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-2449 | Version: | 4 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | VMware Workstation VMware Player |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17231 | |||
Oval ID: | oval:org.mitre.oval:def:17231 | ||
Title: | VMware host memory overwrite vulnerability (function pointers) | ||
Description: | The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2012-1517 | Version: | 4 |
Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | VMware Workstation VMware Player |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20172 | |||
Oval ID: | oval:org.mitre.oval:def:20172 | ||
Title: | VMware Workstation, Player, ESXi and ESX patches address critical security issues | ||
Description: | VMware ESXi 3.5 through 5.0 and ESX 3.5 through 4.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via NFS traffic. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2012-2448 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 VMWare ESX Server 3.5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20501 | |||
Oval ID: | oval:org.mitre.oval:def:20501 | ||
Title: | VMware Workstation, Player, ESXi and ESX patches address critical security issues | ||
Description: | The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2012-1517 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20601 | |||
Oval ID: | oval:org.mitre.oval:def:20601 | ||
Title: | VMware Workstation, Player, ESXi and ESX patches address critical security issues | ||
Description: | The VMX process in VMware ESXi 3.5 through 4.1 and ESX 3.5 through 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving data pointers. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2012-1516 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 VMWare ESX Server 3.5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20618 | |||
Oval ID: | oval:org.mitre.oval:def:20618 | ||
Title: | VMware Workstation, Player, ESXi and ESX patches address critical security issues | ||
Description: | VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2012-2450 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 VMWare ESX Server 3.5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-05-03 | Name : VMSA-2012-0009 VMware Workstation, Player, ESXi and ESX patches address criti... File : nvt/gb_VMSA-2012-0009.nasl |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2012-05-03 | IAVM : 2012-A-0071 - Multiple Vulnerabilities in VMware ESXi 3.5 and ESX 3.5 Severity : Category I - VMSKEY : V0032165 |
2012-05-03 | IAVM : 2012-A-0072 - Multiple Vulnerabilities in VMware ESXi 4.0 and ESX 4.0 Severity : Category I - VMSKEY : V0032167 |
2012-05-03 | IAVM : 2012-A-0073 - Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1 Severity : Category I - VMSKEY : V0032171 |
2012-05-03 | IAVM : 2012-A-0075 - Multiple Vulnerabilities in VMware Fusion Severity : Category I - VMSKEY : V0032174 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-02-29 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2012-0009_remote.nasl - Type : ACT_GATHER_INFO |
2013-11-13 | Name : The remote VMware ESXi 5.0 host is affected by multiple security vulnerabilit... File : vmware_esxi_5_0_build_702118_remote.nasl - Type : ACT_GATHER_INFO |
2012-07-02 | Name : The remote host has a virtualization application that is affected by multiple... File : macosx_fusion_4_1_3.nasl - Type : ACT_GATHER_INFO |
2012-06-11 | Name : The remote VMware ESX/ESXi host is affected by multiple security vulnerabilit... File : vmware_esx_nfs_rce.nasl - Type : ACT_GATHER_INFO |
2012-05-15 | Name : The remote host has a virtualization application affected by multiple vulnera... File : vmware_player_multiple_vmsa_2012_0009.nasl - Type : ACT_GATHER_INFO |
2012-05-15 | Name : The remote host has a virtualization application that is affected by multiple... File : vmware_workstation_multiple_vmsa_2012_0009.nasl - Type : ACT_GATHER_INFO |
2012-05-04 | Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2012-0009.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-03-01 13:26:32 |
|
2014-02-17 12:07:23 |
|
2013-11-11 12:41:41 |
|