The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers.

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities :

  - Multiple privilege escalation vulnerabilities exist due     to improper handling of RPC commands. A local attacker     (guest user) can exploit these to manipulate data and     function pointers, resulting in a denial of service     condition or the execution of arbitrary code on the host     OS. (CVE-2012-1516, CVE-2012-1517)

  - A remote code execution vulnerability exists due to     improper sanitization of user-supplied input when     parsing NFS traffic. An unauthenticated, remote attacker     can exploit this to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2012-2448)

  - Multiple privilege escalation vulnerabilities exist due     to an error that occurs in virtual floppy devices and     SCSI devices. A local attacker (guest user) can exploit     these to cause an out-of-bounds write error, resulting     in a denial of service condition or the execution of     arbitrary code on the host OS. (CVE-2012-2449,     CVE-2012-2450)

The VMware Workstation install detected on the remote host is 7.x earlier than 7.1.6 or 8.0.x earlier than 8.0.3 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory corruption errors exist related to the     RPC commands handler function which could cause the     application to crash or possibly allow an attacker to     execute arbitrary code. Note that these errors only     affect the 3.x branch. (CVE-2012-1516, CVE-2012-1517)

  - An error in the virtual floppy device configuration     can allow out-of-bounds memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges in the guest are required     for successful exploitation along with the existence of     a virtual floppy device in the guest. (CVE-2012-2449)

  - An error in the virtual SCSI device registration     process can allow improper memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges are required in the     guest for successful exploitation along with the     existence of a virtual SCSI device in the guest.
    (CVE-2012-2450)

The VMware Player install detected on the remote host is 3.x earlier than 3.1.6, or 4.0.x earlier than 4.0.3 and is, therefore,  potentially affected by the following vulnerabilities :

  - Memory corruption errors exist related to the     RPC commands handler function which could cause the     application to crash or possibly allow an attacker to     execute arbitrary code. Note that these errors only     affect the 3.x branch. (CVE-2012-1516, CVE-2012-1517)

  - An error in the virtual floppy device configuration     can allow out-of-bounds memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges in the guest are required     for successful exploitation along with the existence of     a virtual floppy device in the guest. (CVE-2012-2449)

  - An error in the virtual SCSI device registration     process can allow improper memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges are required in the     guest for successful exploitation along with the     existence of a virtual SCSI device in the guest.
    (CVE-2012-2450)

a. VMware host memory overwrite vulnerability (data pointers)

   Due to a flaw in the handler function for RPC commands, it is    possible to manipulate data pointers within the VMX process.
   This vulnerability may allow a guest user to crash the VMX    process or potentially execute code on the host.

   Workaround

   - Configure virtual machines to use less than 4 GB of memory.
     Virtual machines that have less than 4GB of memory are not      affected.

     OR

   - Disable VIX messages from each guest VM by editing the      configuration file (.vmx) for the virtual machine as described      in VMware Knowledge Base article 1714. Add the following line :
     isolation.tools.vixMessage.disable = 'TRUE'.
     Note: This workaround is not valid for Workstation 7.x and            Fusion 3.x

   Mitigation

   - Do not allow untrusted users access to your virtual machines.
     Root or Administrator level permissions are not required to      exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1516 to this issue.

   VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

b. VMware host memory overwrite vulnerability (function pointers)

   Due to a flaw in the handler function for RPC commands, it is    possible to manipulate function pointers within the VMX process.
   This vulnerability may allow a guest user to crash the VMX    process or potentially execute code on the host.

   Workaround

   - None identified

   Mitigation

   - Do not allow untrusted users access to your virtual machines.
     Root or Administrator level permissions are not required to      exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1517 to this issue.

   VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

c. ESX NFS traffic parsing vulnerability

   Due to a flaw in the handling of NFS traffic, it is possible to    overwrite memory. This vulnerability may allow a user with    access to the network to execute code on the ESXi/ESX host    without authentication. The issue is not present in cases where    there is no NFS traffic.

   Workaround
   - None identified

   Mitigation
   - Connect only to trusted NFS servers
   - Segregate the NFS network
   - Harden your NFS server

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2448 to this issue.

d. VMware floppy device out-of-bounds memory write

   Due to a flaw in the virtual floppy configuration it is possible    to perform an out-of-bounds memory write. This vulnerability may    allow a guest user to crash the VMX process or potentially    execute code on the host.

   Workaround

   - Remove the virtual floppy drive from the list of virtual IO      devices. The VMware hardening guides recommend removing unused      virtual IO devices in general.

   Mitigation

   - Do not allow untrusted root users in your virtual      machines. Root or Administrator level permissions are required      to exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2449 to this issue.

e. VMware SCSI device unchecked memory write

   Due to a flaw in the SCSI device registration it is possible to    perform an unchecked write into memory. This vulnerability may    allow a guest user to crash the VMX process or potentially    execute code on the host.

   Workaround

   - Remove the virtual SCSI controller from the list of virtual IO      devices. The VMware hardening guides recommend removing unused      virtual IO devices in general.

   Mitigation

   - Do not allow untrusted root users access to your virtual      machines.  Root or Administrator level permissions are      required to exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2450 to this issue.

ID	Name	Product	Family	Severity
89035	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0009) (remote check)	Nessus	Misc.	high
59092	VMware Workstation Multiple Vulnerabilities (VMSA-2012-0009)	Nessus	Windows	high
59091	VMware Player Multiple Vulnerabilities (VMSA-2012-0009)	Nessus	Windows	high
58977	VMSA-2012-0009 : VMware Workstation, Player, Fusion, ESXi and ESX patches address critical security issues	Nessus	VMware ESX Local Security Checks	critical

Detections

Analytics

CVE-2012-1517

high

Tenable Plugins

high

high

high

critical