Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5, VMware Fusion 3.1.x before 3.1.3, and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image.

The remote host is affected by the vulnerability described in GLSA-201209-25 (VMware Player, Server, Workstation: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in VMware Player, Server,       and Workstation. Please review the CVE identifiers referenced below for       details.
  Impact :

    Local users may be able to gain escalated privileges, cause a Denial of       Service, or gain sensitive information.
    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in the remote execution of arbitrary code, or a Denial       of Service. Remote attackers also may be able to spoof DNS traffic, read       arbitrary files, or inject arbitrary web script to the VMware Server       Console.
    Furthermore, guest OS users may be able to execute arbitrary code on the       host OS, gain escalated privileges on the guest OS, or cause a Denial of       Service (crash the host OS).
  Workaround :

    There is no known workaround at this time.

The version of VMware Fusion installed on the Mac OS X host is earlier than 3.1.3.  As such, it is reportedly affected by the following three security vulnerabilities :

  - An attacker with access to a Guest operating system can     determine if a path exists in the Host filesystem and     whether it's a file or a directory regardless of     permissions. (CVE-2011-2146)

  - A race condition in mount.vmhgfs may allow an attacker     with access to a Guest to mount on arbitrary directories     in the Guest filesystem and escalate their privileges if     they can control the contents of the mounted directory.
    (CVE-2011-1787)

  - A procedural error allows an attacker with access to a     Solaris or FreeBSD Guest operating system to gain write     access to an arbitrary file in the Guest filesystem.
    (CVE-2011-2145)

  - A buffer overflow in the way UDF file systems are     handled could allow for code execution if a specially     crafted ISO image is used. (CVE-2011-3868)

Note that the first three vulnerabilities only affect non-Windows guest operating systems.

ID	Name	Product	Family	Severity
62383	GLSA-201209-25 : VMware Player, Server, Workstation: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
54974	VMware Fusion < 3.1.3 (VMSA-2011-0009 / VMSA-2011-0011)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2011-3868

critical

Tenable Plugins

medium

high