The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash) via an invalid value in a (1) RetrieveProp or (2) RetrievePropEx SOAP request.
http://www.vmware.com/security/advisories/VMSA-2012-0016.html
http://www.securitytracker.com/id?1027782
http://www.securityfocus.com/bid/56571
http://www.coresecurity.com/content/vmware-esx-input-validation-error