VMware ESXi 3.5 through 5.0 and ESX 3.5 through 4.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via NFS traffic.

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities :

  - Multiple privilege escalation vulnerabilities exist due     to improper handling of RPC commands. A local attacker     (guest user) can exploit these to manipulate data and     function pointers, resulting in a denial of service     condition or the execution of arbitrary code on the host     OS. (CVE-2012-1516, CVE-2012-1517)

  - A remote code execution vulnerability exists due to     improper sanitization of user-supplied input when     parsing NFS traffic. An unauthenticated, remote attacker     can exploit this to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2012-2448)

  - Multiple privilege escalation vulnerabilities exist due     to an error that occurs in virtual floppy devices and     SCSI devices. A local attacker (guest user) can exploit     these to cause an out-of-bounds write error, resulting     in a denial of service condition or the execution of     arbitrary code on the host OS. (CVE-2012-2449,     CVE-2012-2450)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - An error exists related to NFS traffic handling that     could allow memory corruption leading to execution of     arbitrary code. (CVE-2012-2448)

  - Out-of-bounds write errors exist related to virtual     floppy disc devices and virtual SCSI devices that could     allow local privilege escalation. (CVE-2012-2449,     CVE-2012-2450)

The remote VMware ESX/ESXi host is affected by the following security vulnerabilities :

  - ESX NFS traffic parsing vulnerability:
    Due to a flaw in the handling of NFS traffic, it is     possible to overwrite memory. This vulnerability may     allow a user with access to the network to execute code     on the ESXi/ESX host without authentication. The issue     is not present in cases where there is no NFS traffic.
    (CVE-2012-2448)

  - VMware floppy device out-of-bounds memory write:
    Due to a flaw in the virtual floppy configuration it is     possible to perform an out-of-bounds memory write. This     vulnerability may allow a guest user to crash the VMX     process or potentially execute code on the host. As a     workaround, remove the virtual floppy drive from the     list of virtual IO devices. The VMware hardening guides     recommend removing unused virtual IO devices in general.
    Additionally, do not allow untrusted root users in your     virtual machines. Root or Administrator level     permissions are required to exploit this issue.
    (CVE-2012-2449)

  - VMware SCSI device unchecked memory write:
    Due to a flaw in the SCSI device registration it is     possible to perform an unchecked write into memory.
    This vulnerability may allow a guest user to crash the     VMX process or potentially execute code on the host. As     a workaround, remove the virtual SCSI controller from     the list of virtual IO devices. The VMware hardening     guides recommend removing unused virtual IO devices in     general. Additionally, do not allow untrusted root users     access to your virtual machines. Root or Administrator     level permissions are required to exploit this issue.
    (CVE-2012-2450)

a. VMware host memory overwrite vulnerability (data pointers)

   Due to a flaw in the handler function for RPC commands, it is    possible to manipulate data pointers within the VMX process.
   This vulnerability may allow a guest user to crash the VMX    process or potentially execute code on the host.

   Workaround

   - Configure virtual machines to use less than 4 GB of memory.
     Virtual machines that have less than 4GB of memory are not      affected.

     OR

   - Disable VIX messages from each guest VM by editing the      configuration file (.vmx) for the virtual machine as described      in VMware Knowledge Base article 1714. Add the following line :
     isolation.tools.vixMessage.disable = 'TRUE'.
     Note: This workaround is not valid for Workstation 7.x and            Fusion 3.x

   Mitigation

   - Do not allow untrusted users access to your virtual machines.
     Root or Administrator level permissions are not required to      exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1516 to this issue.

   VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

b. VMware host memory overwrite vulnerability (function pointers)

   Due to a flaw in the handler function for RPC commands, it is    possible to manipulate function pointers within the VMX process.
   This vulnerability may allow a guest user to crash the VMX    process or potentially execute code on the host.

   Workaround

   - None identified

   Mitigation

   - Do not allow untrusted users access to your virtual machines.
     Root or Administrator level permissions are not required to      exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1517 to this issue.

   VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

c. ESX NFS traffic parsing vulnerability

   Due to a flaw in the handling of NFS traffic, it is possible to    overwrite memory. This vulnerability may allow a user with    access to the network to execute code on the ESXi/ESX host    without authentication. The issue is not present in cases where    there is no NFS traffic.

   Workaround
   - None identified

   Mitigation
   - Connect only to trusted NFS servers
   - Segregate the NFS network
   - Harden your NFS server

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2448 to this issue.

d. VMware floppy device out-of-bounds memory write

   Due to a flaw in the virtual floppy configuration it is possible    to perform an out-of-bounds memory write. This vulnerability may    allow a guest user to crash the VMX process or potentially    execute code on the host.

   Workaround

   - Remove the virtual floppy drive from the list of virtual IO      devices. The VMware hardening guides recommend removing unused      virtual IO devices in general.

   Mitigation

   - Do not allow untrusted root users in your virtual      machines. Root or Administrator level permissions are required      to exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2449 to this issue.

e. VMware SCSI device unchecked memory write

   Due to a flaw in the SCSI device registration it is possible to    perform an unchecked write into memory. This vulnerability may    allow a guest user to crash the VMX process or potentially    execute code on the host.

   Workaround

   - Remove the virtual SCSI controller from the list of virtual IO      devices. The VMware hardening guides recommend removing unused      virtual IO devices in general.

   Mitigation

   - Do not allow untrusted root users access to your virtual      machines.  Root or Administrator level permissions are      required to exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2450 to this issue.

ID	Name	Product	Family	Severity
89035	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0009) (remote check)	Nessus	Misc.	high
70882	ESXi 5.0 < Build 702118 Multiple Vulnerabilities (remote check)	Nessus	Misc.	high
59447	VMSA-2012-0009 : ESXi and ESX patches address critical security issues (uncredentialed check)	Nessus	Gain a shell remotely	high
58977	VMSA-2012-0009 : VMware Workstation, Player, Fusion, ESXi and ESX patches address critical security issues	Nessus	VMware ESX Local Security Checks	critical

Detections

Analytics

CVE-2012-2448

critical

Tenable Plugins

high

high

high

critical