PT-2012-3321 · Vmware+1 · Vmware Esxi+1

Publicado 2012-04-02 · Atualizado 2018-10-12 · CVE-2012-1515

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 3.5 through 4.1 VMware ESX versions 3.5 through 4.1

Description The issue concerns improper implementation of port-based I/O operations, allowing guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine. Additionally, there is an elevation of privilege issue related to how Windows handles BIOS memory, which could allow an attacker to run arbitrary code in kernel mode, enabling them to install programs, view, change, or delete data, or create new accounts with full administrative rights.

Recommendations For VMware ESXi versions 3.5 through 4.1, consider restricting access to the Virtual DOS Machine to minimize the risk of exploitation. For VMware ESX versions 3.5 through 4.1, consider restricting access to the Virtual DOS Machine to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-1515

Produtos afetados

Vmware Esxi

Windows

Referências · 12

• http://technet.microsoft.com/en-us/security/bulletin/ms12-042 · Nota
• http://us-cert.gov/cas/techalerts/TA12-164A.html · Nota
• http://securitytracker.com/id?1026875 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1515 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2012-0006.html · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-042 · Aviso do Fabricante
• http://securityfocus.com/bid/52820 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15209 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17110 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74480 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1515 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1515 · Nota de Segurança