VMware ESXi 3.5, 4.0, and 4.1 and ESX 3.5, 4.0, and 4.1 do not properly implement port-based I/O operations, which allows guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Kernel
  - krb5 telnet daemon

The remote host is running a Windows kernel version that is affected by multiple elevation of privilege vulnerabilities :

  - A vulnerability exists in the way that the Windows User     Mode Scheduler handles system requests that can be     exploited to execute arbitrary code in kernel mode.
    (CVE-2012-0217)

  - A vulnerability exists in the way that Windows handles     BIOS memory that can be exploited to execute arbitrary     code in kernel mode. (CVE-2012-1515)

a. VMware ROM Overwrite Privilege Escalation     A flaw in the way port-based I/O is handled allows for modifying    Read-Only Memory that belongs to the Virtual DOS Machine.
   Exploitation of this issue may lead to privilege escalation on    Guest Operating Systems that run Windows 2000, Windows XP    32-bit, Windows Server 2003 32-bit or Windows Server 2003 R2    32-bit.
    VMware would like to thank Derek Soeder of Ridgeway Internet    Security, L.L.C. for reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1515 to this issue.
 b. ESX third-party update for Service Console kernel     The ESX Service Console Operating System (COS) kernel is updated    to kernel-400.2.6.18-238.4.11.591731 to fix multiple security    issues in the COS kernel.
    The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2011-2482, CVE-2011-3191 and    CVE-2011-4348 to these issues.
 c. ESX third-party update for Service Console krb5 RPM     This patch updates the krb5-libs and krb5-workstation RPMs to    version 1.6.1-63.el5_7 to resolve a security issue.
    By default, the affected krb5-telnet and ekrb5-telnet services    do not run. The krb5 telnet daemon is an xinetd service.  You    can run the following commands to check if krb5 telnetd is    enabled :

     /sbin/chkconfig --list krb5-telnet      /sbin/chkconfig --list ekrb5-telnet      The output of these commands displays if krb5 telnet is enabled.
     You can run the following commands to disable krb5 telnet    daemon :

     /sbin/chkconfig krb5-telnet off      /sbin/chkconfig ekrb5-telnet off     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2011-4862 to this issue.

ID	Name	Product	Family	Severity
89107	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0006) (remote check)	Nessus	Misc.	critical
59460	MS12-042: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167)	Nessus	Windows : Microsoft Bulletins	high
58535	VMSA-2012-0006 : VMware Workstation, ESXi, and ESX address several security issues	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2012-1515

critical

Tenable Plugins

critical

high

high