Detections
Analytics

VMSA-2020-0011 : VMware ESXi updates address multiple security vulnerabilities

medium Nessus Plugin ID 137047

Language:

Synopsis

The remote VMware ESXi host is missing one or more security-related patches.

Description

b. Denial-of-service vulnerability in Shader functionality (CVE-2020-3958)

Description :
VMware ESXi, Workstation and Fusion contain a denial-of-service vulnerability in the shader functionality. Exploitation of this issue requires an attacker to have access to a virtual machine with 3D graphics enabled. It is not enabled by default on ESXi.

Successful exploitation of this issue may allow attackers with non-administrative access to a virtual machine to crash the virtual machine's vmx process leading to a denial of service condition.

c. Memory leak vulnerability in VMCI module (CVE-2020-3959) Description :

VMware ESXi, Workstation and Fusion contain a memory leak vulnerability in the VMCI module.
 A malicious actor with local non-administrative access to a virtual machine may be able to crash the virtual machine's vmx process leading to a partial denial of service.

Solution

Apply the missing patches.

See Also

http://lists.vmware.com/pipermail/security-announce/2020/000496.html

Plugin Details

Severity: Medium

ID: 137047

File Name: vmware_VMSA-2020-0011.nasl

Version: 1.6

Type: local

Published: 6/2/2020

Updated: 3/8/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2020-3959

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2020-3958

Vulnerability Information

CPE: cpe:/o:vmware:esxi:6.5, cpe:/o:vmware:esxi:6.7

Required KB Items: Host/local_checks_enabled, Host/VMware/release, Host/VMware/version

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2020

Vulnerability Publication Date: 5/29/2020

Reference Information

CVE: CVE-2020-3958, CVE-2020-3959

IAVA: 2020-A-0234

VMSA: 2020-0011