The CPU hardware emulation for 64-bit guest operating systems in VMware Workstation 6.0.x before 6.0.5 build 109488 and 5.x before 5.5.8 build 108000; Player 2.0.x before 2.0.5 build 109488 and 1.x before 1.0.8; Server 1.x before 1.0.7 build 108231; and ESX 2.5.4 through 3.5 allows authenticated guest OS users to gain additional guest OS privileges by triggering an exception that causes the virtual CPU to perform an indirect jump to a non-canonical address.

a.  Privilege escalation on 64-bit guest operating systems

  VMware products emulate hardware functions, like CPU, Memory, and   IO.  

  A flaw in VMware's CPU hardware emulation could allow the   virtual CPU to jump to an incorrect memory address. Exploitation of   this issue on the guest operating system does not lead to a   compromise of the host system but could lead to a privilege   escalation on guest operating system.  An attacker would need to   have a user account on the guest operating system.

  Affected   64-bit Windows and 64-bit FreeBSD guest operating systems and   possibly other 64-bit operating systems. The issue does not   affect the 64-bit versions of Linux guest operating systems.

  VMware would like to thank Derek Soeder for discovering   this issue and working with us on its remediation.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2008-4279 this issue.

 b. Update for VirtualCenter fixes a potential information disclosure

 This release resolves an issue where a user's password could be  displayed in cleartext. When logging into VirtualCenter Server 2.0  with Virtual Infrastructure Client 2.5, the user password might be  displayed if it contains certain special characters. The dialog  box displaying the password can appear in front or hidden behind  other windows.

 To remediate this issue the VirtualCenter client installations must  be updated after updating to VirtualCenter Update 3

 VMware would like to thank Mark Woollatt for reporting this issue  to VMware.

 The Common Vulnerabilities and Exposures project (cve.mitre.org)  has assigned the name CVE-2008-4278 to this issue.

 c. Update for VirtualCenter updates JRE to version 1.5.0_16

 Update for VirtualCenter updates the JRE package to version 1.5.0_16,  which addresses multiple security issues that existed in the previous  version of JRE.

 The Common Vulnerabilities and Exposures project (cve.mitre.org)  has assigned the names CVE-2008-3103, CVE-2008-3104, CVE-2008-3105,  CVE-2008-3106, CVE-2008-3107, CVE-2008-3108, CVE-2008-3109,  CVE-2008-3110, CVE-2008-3111, CVE-2008-3112, CVE-2008-3113,  CVE-2008-3114, CVE-2008-3115 to the security issues fixed in  JRE 1.5.0_16.

A VMware product installed on the remote host is affected by multiple vulnerabilities :

  - ActiveX controls provided by VMware for IE could be     exploited to cause a denial of service condition or     execute arbitrary code on the remote system.
    (CVE-2007-5438, CVE-2008-3691-CVE-2008-3696,     CVE-2008-3892)

  - Internet Server Application Programming Interface     (ISAPI) extensions provided by VMware are affected     by a remote denial of service vulnerability.
    (CVE-2008-3697)

  - Certain VMware products running as host systems are     affected by a local privilege escalation vulnerability.
    Successful exploitation of this issue would allow     users to execute arbitrary code on the system.
    (CVE-2008-3698)

  - A flaw in VMware's CPU hardware emulation could result     in privilege escalation on guest systems running on     64-bit operating systems. (CVE-2008-4279)

ID	Name	Product	Family	Severity
40383	VMSA-2008-0016 : VMware Hosted products, VirtualCenter Update 3 and patches for ESX and ESXi resolve multiple security issues	Nessus	VMware ESX Local Security Checks	critical
34156	VMware Products Multiple Vulnerabilities (VMSA-2008-0014)	Nessus	Windows	high

Detections

Analytics

CVE-2008-4279

high

Tenable Plugins

critical

high