VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities :

  - Multiple privilege escalation vulnerabilities exist due     to improper handling of RPC commands. A local attacker     (guest user) can exploit these to manipulate data and     function pointers, resulting in a denial of service     condition or the execution of arbitrary code on the host     OS. (CVE-2012-1516, CVE-2012-1517)

  - A remote code execution vulnerability exists due to     improper sanitization of user-supplied input when     parsing NFS traffic. An unauthenticated, remote attacker     can exploit this to corrupt memory, resulting in the     execution of arbitrary code. (CVE-2012-2448)

  - Multiple privilege escalation vulnerabilities exist due     to an error that occurs in virtual floppy devices and     SCSI devices. A local attacker (guest user) can exploit     these to cause an out-of-bounds write error, resulting     in a denial of service condition or the execution of     arbitrary code on the host OS. (CVE-2012-2449,     CVE-2012-2450)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - An error exists related to NFS traffic handling that     could allow memory corruption leading to execution of     arbitrary code. (CVE-2012-2448)

  - Out-of-bounds write errors exist related to virtual     floppy disc devices and virtual SCSI devices that could     allow local privilege escalation. (CVE-2012-2449,     CVE-2012-2450)

The version of VMware Fusion 4.x installed on the Mac OS X host is earlier than 4.1.3, and is therefore reportedly affected by the following vulnerabilities :

  - Due to a flaw in the virtual floppy configuration it is     possible to perform an out-of-bounds memory write. This     vulnerability may allow a guest user to crash the VMX     process or potentially execute code on the host. As a     workaround, remove the virtual floppy drive from the     list of virtual IO devices. The VMware hardening guides     recommend removing unused virtual IO devices in general.
    Additionally, do not allow untrusted root users in your     virtual machines. Root or Administrator level     permissions are required to exploit this issue.
    (CVE-2012-2449)

  - A memory corruption error exists related to the     handling of 'Checkpoint' files that can allow arbitrary     code execution. (CVE-2012-3288)

The remote VMware ESX/ESXi host is affected by the following security vulnerabilities :

  - ESX NFS traffic parsing vulnerability:
    Due to a flaw in the handling of NFS traffic, it is     possible to overwrite memory. This vulnerability may     allow a user with access to the network to execute code     on the ESXi/ESX host without authentication. The issue     is not present in cases where there is no NFS traffic.
    (CVE-2012-2448)

  - VMware floppy device out-of-bounds memory write:
    Due to a flaw in the virtual floppy configuration it is     possible to perform an out-of-bounds memory write. This     vulnerability may allow a guest user to crash the VMX     process or potentially execute code on the host. As a     workaround, remove the virtual floppy drive from the     list of virtual IO devices. The VMware hardening guides     recommend removing unused virtual IO devices in general.
    Additionally, do not allow untrusted root users in your     virtual machines. Root or Administrator level     permissions are required to exploit this issue.
    (CVE-2012-2449)

  - VMware SCSI device unchecked memory write:
    Due to a flaw in the SCSI device registration it is     possible to perform an unchecked write into memory.
    This vulnerability may allow a guest user to crash the     VMX process or potentially execute code on the host. As     a workaround, remove the virtual SCSI controller from     the list of virtual IO devices. The VMware hardening     guides recommend removing unused virtual IO devices in     general. Additionally, do not allow untrusted root users     access to your virtual machines. Root or Administrator     level permissions are required to exploit this issue.
    (CVE-2012-2450)

The VMware Workstation install detected on the remote host is 7.x earlier than 7.1.6 or 8.0.x earlier than 8.0.3 and is, therefore, potentially affected by the following vulnerabilities :

  - Memory corruption errors exist related to the     RPC commands handler function which could cause the     application to crash or possibly allow an attacker to     execute arbitrary code. Note that these errors only     affect the 3.x branch. (CVE-2012-1516, CVE-2012-1517)

  - An error in the virtual floppy device configuration     can allow out-of-bounds memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges in the guest are required     for successful exploitation along with the existence of     a virtual floppy device in the guest. (CVE-2012-2449)

  - An error in the virtual SCSI device registration     process can allow improper memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges are required in the     guest for successful exploitation along with the     existence of a virtual SCSI device in the guest.
    (CVE-2012-2450)

The VMware Player install detected on the remote host is 3.x earlier than 3.1.6, or 4.0.x earlier than 4.0.3 and is, therefore,  potentially affected by the following vulnerabilities :

  - Memory corruption errors exist related to the     RPC commands handler function which could cause the     application to crash or possibly allow an attacker to     execute arbitrary code. Note that these errors only     affect the 3.x branch. (CVE-2012-1516, CVE-2012-1517)

  - An error in the virtual floppy device configuration     can allow out-of-bounds memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges in the guest are required     for successful exploitation along with the existence of     a virtual floppy device in the guest. (CVE-2012-2449)

  - An error in the virtual SCSI device registration     process can allow improper memory writes and can allow     a guest user to crash the VMX process or potentially     execute arbitrary code on the host. Note that root or     administrator level privileges are required in the     guest for successful exploitation along with the     existence of a virtual SCSI device in the guest.
    (CVE-2012-2450)

a. VMware host memory overwrite vulnerability (data pointers)

   Due to a flaw in the handler function for RPC commands, it is    possible to manipulate data pointers within the VMX process.
   This vulnerability may allow a guest user to crash the VMX    process or potentially execute code on the host.

   Workaround

   - Configure virtual machines to use less than 4 GB of memory.
     Virtual machines that have less than 4GB of memory are not      affected.

     OR

   - Disable VIX messages from each guest VM by editing the      configuration file (.vmx) for the virtual machine as described      in VMware Knowledge Base article 1714. Add the following line :
     isolation.tools.vixMessage.disable = 'TRUE'.
     Note: This workaround is not valid for Workstation 7.x and            Fusion 3.x

   Mitigation

   - Do not allow untrusted users access to your virtual machines.
     Root or Administrator level permissions are not required to      exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1516 to this issue.

   VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

b. VMware host memory overwrite vulnerability (function pointers)

   Due to a flaw in the handler function for RPC commands, it is    possible to manipulate function pointers within the VMX process.
   This vulnerability may allow a guest user to crash the VMX    process or potentially execute code on the host.

   Workaround

   - None identified

   Mitigation

   - Do not allow untrusted users access to your virtual machines.
     Root or Administrator level permissions are not required to      exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1517 to this issue.

   VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

c. ESX NFS traffic parsing vulnerability

   Due to a flaw in the handling of NFS traffic, it is possible to    overwrite memory. This vulnerability may allow a user with    access to the network to execute code on the ESXi/ESX host    without authentication. The issue is not present in cases where    there is no NFS traffic.

   Workaround
   - None identified

   Mitigation
   - Connect only to trusted NFS servers
   - Segregate the NFS network
   - Harden your NFS server

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2448 to this issue.

d. VMware floppy device out-of-bounds memory write

   Due to a flaw in the virtual floppy configuration it is possible    to perform an out-of-bounds memory write. This vulnerability may    allow a guest user to crash the VMX process or potentially    execute code on the host.

   Workaround

   - Remove the virtual floppy drive from the list of virtual IO      devices. The VMware hardening guides recommend removing unused      virtual IO devices in general.

   Mitigation

   - Do not allow untrusted root users in your virtual      machines. Root or Administrator level permissions are required      to exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2449 to this issue.

e. VMware SCSI device unchecked memory write

   Due to a flaw in the SCSI device registration it is possible to    perform an unchecked write into memory. This vulnerability may    allow a guest user to crash the VMX process or potentially    execute code on the host.

   Workaround

   - Remove the virtual SCSI controller from the list of virtual IO      devices. The VMware hardening guides recommend removing unused      virtual IO devices in general.

   Mitigation

   - Do not allow untrusted root users access to your virtual      machines.  Root or Administrator level permissions are      required to exploit this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2450 to this issue.

ID	Name	Product	Family	Severity
89035	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0009) (remote check)	Nessus	Misc.	high
70882	ESXi 5.0 < Build 702118 Multiple Vulnerabilities (remote check)	Nessus	Misc.	high
59818	VMware Fusion 4.x < 4.1.3 (VMSA-2012-0009, VMSA-2012-0011)	Nessus	MacOS X Local Security Checks	high
59447	VMSA-2012-0009 : ESXi and ESX patches address critical security issues (uncredentialed check)	Nessus	Gain a shell remotely	high
59092	VMware Workstation Multiple Vulnerabilities (VMSA-2012-0009)	Nessus	Windows	high
59091	VMware Player Multiple Vulnerabilities (VMSA-2012-0009)	Nessus	Windows	high
58977	VMSA-2012-0009 : VMware Workstation, Player, Fusion, ESXi and ESX patches address critical security issues	Nessus	VMware ESX Local Security Checks	critical

Detections

Analytics

CVE-2012-2449

high

Tenable Plugins

high

high

high

high

high

high

critical