PT-2012-4052 · Vmware · Vmware Player+3

Publicado 2012-05-04 · Atualizado 2017-12-14 · CVE-2012-2449

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 8.0.0 through 8.0.2 VMware Player versions 4.0.0 through 4.0.2 VMware Fusion versions 4.0.0 through 4.1.2 VMware ESXi versions 3.5 through 5.0 VMware ESX versions 3.5 through 4.1

Description The issue arises from the improper configuration of the virtual floppy device, allowing users with administrative privileges on the guest OS to potentially cause a denial of service or execute arbitrary code on the host OS. This can be achieved through an out-of-bounds write operation, which may result in the crash of the VMX process.

Recommendations For VMware Workstation versions 8.0.0 through 8.0.2, update to version 8.0.3 or later. For VMware Player versions 4.0.0 through 4.0.2, update to version 4.0.3 or later. For VMware Fusion versions 4.0.0 through 4.1.2, update to a version later than 4.1.2. For VMware ESXi versions 3.5 through 5.0, update to a version later than 5.0. For VMware ESX versions 3.5 through 4.1, update to a version later than 4.1.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-2449

Produtos afetados

Vmware Esxi

Vmware Fusion

Vmware Player

Vmware Workstation

Referências · 9

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75376 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2449 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2012-0009.html · Nota
• http://securityfocus.com/bid/53369 · Nota
• http://osvdb.org/81694 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2449 · Nota
• http://secunia.com/advisories/49032 · Nota
• http://securitytracker.com/id?1027019 · Nota