VMware ESXi 4.0 through 5.1 and ESX 4.0 and 4.1 allow remote attackers to cause a denial of service (NULL pointer dereference) by intercepting and modifying Network File Copy (NFC) traffic.

The remote VMware ESX / ESXi host is affected by multiple denial of service vulnerabilities :

    - A denial of service vulnerability exists due to a NULL       pointer deference flaw when handling Network File Copy       (NFC) traffic. An unauthenticated, remote attacker can       exploit this by intercepting and modifying the traffic       between the ESX / ESXi host and the client.
      (CVE-2014-1207)

    - A flaw exists due to improper handling of invalid       ports. An unauthenticated attacker on an adjacent       network can exploit this to cause VMX processing to       fail, resulting in a partial denial of service.
      (CVE-2014-1208)

The remote VMware ESXi 5.1 host is affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the bundled     OpenSSL library that is triggered when handling OCSP     response verification. A remote attacker can exploit     this to crash the program. (CVE-2013-0166)

  - An error exists related to the SSL/TLS/DTLS protocols,     CBC mode encryption and response time. An attacker     can obtain plaintext contents of encrypted traffic via     timing attacks. (CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities that could allow     denial of service attacks. (CVE-2013-0338)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. An attacker can     exploit this by intercepting and modifying NFC traffic,     to cause a denial of service condition. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

a. VMware ESXi and ESX NFC NULL pointer dereference

      VMware ESXi and ESX contain a NULL pointer dereference in       the handling of the Network File Copy (NFC) traffic. To       exploit this vulnerability, an attacker must intercept and       modify the NFC traffic between ESXi/ESX and the client.        Exploitation of the issue may lead to a Denial of Service.

      To reduce the likelihood of exploitation, vSphere components        should be deployed on an isolated management network.
           VMware would like to thank Alex Chapman of Context Information       Security for reporting this issue to us.

      The Common Vulnerabilities and Exposures project (cve.mitre.org) has       assigned the name CVE-2014-1207 to this issue.

b. VMware VMX process denial of service vulnerability

      Due to a flaw in the handling of invalid ports, it is possible       to cause the VMX process to fail. This vulnerability may allow a       guest user to affect the VMX process resulting in a partial denial of       service on the host.

      VMware would like to thank Recurity Labs GmbH and the Bundesamt       Sicherheit in der Informationstechnik (BSI) for reporting this       issue to us

      The Common Vulnerabilities and Exposures project (cve.mitre.org) has       assigned the name CVE-2014-1208 to this issue.

c. VMware vCloud Director Cross Site Request Forgery (CSRF)

      VMware vCloud Director contains a vulnerability in the Hyper Text Transfer       Protocol (http) session management. An attacker may trick an authenticated       user to click a malicious link, which would result in the user being logged       out. The user is able to immediately log back into the system. 

      VMware would like to thank Mattia Folador for reporting this issue to us.

      The Common Vulnerabilities and Exposures project (cve.mitre.org) has       assigned the name CVE-2014-1211 to this issue.

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - Multiple errors exist related to OpenSSL that could     allow information disclosure or denial of service     attacks. (CVE-2013-0166, CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities. An attacker can     exploit this to cause a denial of service. (CVE-2013-0338)

  - An unspecified error exists related to 'hostd-vmdb'. An     attacker can exploit this to cause a denial of service.
    (CVE-2013-5970)

  - An error exists in the handling of certain Virtual     Machine file descriptors. This may allow an unprivileged     user with the 'Add Existing Disk' privilege to obtain     read and write access to arbitrary files, possibly     leading to arbitrary code execution after a host reboot.
    (CVE-2013-5973)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. This issue may lead     to a denial of service if an attacker intercepts and     modifies the NFC traffic. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

ID	Name	Product	Family	Severity
87673	VMware ESX / ESXi Multiple DoS (VMSA-2014-0001)	Nessus	Misc.	medium
72037	ESXi 5.1 < Build 1483097 Multiple Vulnerabilities (remote check)	Nessus	Misc.	low
72006	VMSA-2014-0001 : VMware Workstation, Player, Fusion, ESXi, ESX and vCloud Director address several security issues	Nessus	VMware ESX Local Security Checks	medium
70879	ESXi 5.0 < Build 1311175 Multiple Vulnerabilities (remote check)	Nessus	Misc.	medium

Detections

Analytics

CVE-2014-1207

high

Tenable Plugins

medium

low

medium

medium