PT-2012-4052 · Vmware · Vmware Player+3

Published 2012-05-04 · Updated 2017-12-14 · CVE-2012-2449

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 8.0.0 through 8.0.2 VMware Player versions 4.0.0 through 4.0.2 VMware Fusion versions 4.0.0 through 4.1.2 VMware ESXi versions 3.5 through 5.0 VMware ESX versions 3.5 through 4.1

Description The issue arises from the improper configuration of the virtual floppy device, allowing users with administrative privileges on the guest OS to potentially cause a denial of service or execute arbitrary code on the host OS. This can be achieved through an out-of-bounds write operation, which may result in the crash of the VMX process.

Recommendations For VMware Workstation versions 8.0.0 through 8.0.2, update to version 8.0.3 or later. For VMware Player versions 4.0.0 through 4.0.2, update to version 4.0.3 or later. For VMware Fusion versions 4.0.0 through 4.1.2, update to a version later than 4.1.2. For VMware ESXi versions 3.5 through 5.0, update to a version later than 5.0. For VMware ESX versions 3.5 through 4.1, update to a version later than 4.1.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-2449

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Player

Vmware Workstation

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2012-2449 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75376 · Note
• http://vmware.com/security/advisories/VMSA-2012-0009.html · Note
• http://securityfocus.com/bid/53369 · Note
• http://osvdb.org/81694 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2449 · Note
• http://secunia.com/advisories/49032 · Note
• http://securitytracker.com/id?1027019 · Note