VMware Workstation 7.x before 7.1.6 and 8.x before 8.0.4, VMware Player 3.x before 3.1.6 and 4.x before 4.0.4, VMware Fusion 4.x before 4.1.3, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow user-assisted remote attackers to execute arbitrary code on the host OS or cause a denial of service (memory corruption) on the host OS via a crafted Checkpoint file.

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper sanitization of user-supplied input. A remote     attacker can exploit this, via a specially crafted     checkpoint file, to corrupt memory, resulting in a     denial of service condition or the execution of     arbitrary code on the host OS. (CVE-2012-3288)

  - A denial of service vulnerability exists due to     improper handling of traffic originating from mobile     virtual devices. A remote attacker can exploit this to     crash the guest OS. (CVE-2012-3289)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - An error exists related to handling checkpoint files     that could allow memory corruption leading to arbitrary     code execution. (CVE-2012-3288)

  - An error exists related to handling mobile device     traffic data that could lead to denial of service     conditions. (CVE-2012-3289)

The version of VMware Fusion 4.x installed on the Mac OS X host is earlier than 4.1.3, and is therefore reportedly affected by the following vulnerabilities :

  - Due to a flaw in the virtual floppy configuration it is     possible to perform an out-of-bounds memory write. This     vulnerability may allow a guest user to crash the VMX     process or potentially execute code on the host. As a     workaround, remove the virtual floppy drive from the     list of virtual IO devices. The VMware hardening guides     recommend removing unused virtual IO devices in general.
    Additionally, do not allow untrusted root users in your     virtual machines. Root or Administrator level     permissions are required to exploit this issue.
    (CVE-2012-2449)

  - A memory corruption error exists related to the     handling of 'Checkpoint' files that can allow arbitrary     code execution. (CVE-2012-3288)

The VMware Workstation install detected on the remote host is 7.x earlier than 7.1.6, or 8.0.x earlier than 8.0.4 and is, therefore, potentially affected by the following vulnerabilities :

  - A memory corruption error exists related to the     handling of 'Checkpoint' files that can allow arbitrary     code execution. (CVE-2012-3288)

  - An error exists related to handling traffic from     remote physical devices, e.g. CD-ROM or mouse that     can cause the virtual machine to cash. Note that this     issue only affects the 8.x branch. (CVE-2012-3289)

The VMware Player install detected on the remote host is 3.x earlier than 3.1.6, or 4.0.x, earlier than 4.0.4 and is, therefore, potentially affected by the following vulnerabilities :

  - A memory corruption error exists related to the     handling of 'Checkpoint' files that can allow arbitrary     code execution. (CVE-2012-3288)

  - An error exists related to handling traffic from     remote physical devices, e.g. CD-ROM or mouse that     can cause the virtual machine to crash. Note that this     issue affects only the 4.x branch. (CVE-2012-3289)

a. VMware Host Checkpoint file memory corruption

   Input data is not properly validated when loading Checkpoint files.
   This may allow an attacker with the ability to load a specially    crafted Checkpoint file to execute arbitrary code on the host.

   Workaround
   - None identified

   Mitigation
   - Do not import virtual machines from untrusted sources.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-3288 to this issue.

b. VMware Virtual Machine Remote Device Denial of Service

   A device (e.g. CD-ROM, keyboard) that is available to a virtual    machine while physically connected to a system that does not run the    virtual machine is referred to as a remote device.

   Traffic coming from remote virtual devices is incorrectly handled.
   This may allow an attacker who is capable of manipulating the    traffic from a remote virtual device to crash the virtual machine.

   Workaround
   - None identified

   Mitigation
   - Users need administrative privileges on the virtual machine      in order to attach remote devices.
   - Do not attach untrusted remote devices to a virtual machine.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-3289 to this issue.

ID	Name	Product	Family	Severity
89036	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0011) (remote check)	Nessus	Misc.	high
70883	ESXi 5.0 < Build 721882 Multiple Vulnerabilities (remote check)	Nessus	Misc.	high
59818	VMware Fusion 4.x < 4.1.3 (VMSA-2012-0009, VMSA-2012-0011)	Nessus	MacOS X Local Security Checks	high
59730	VMware Workstation Multiple Vulnerabilities (VMSA-2012-0011)	Nessus	Windows	high
59729	VMware Player Multiple Vulnerabilities (VMSA-2012-0011)	Nessus	Windows	high
59506	VMSA-2012-0011 : VMware hosted products and ESXi and ESX patches address security issues	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2012-3288

high

Tenable Plugins

high

high

high

high

high

high