VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to cause a denial of service (guest OS crash) via crafted traffic from a remote virtual device.

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper sanitization of user-supplied input. A remote     attacker can exploit this, via a specially crafted     checkpoint file, to corrupt memory, resulting in a     denial of service condition or the execution of     arbitrary code on the host OS. (CVE-2012-3288)

  - A denial of service vulnerability exists due to     improper handling of traffic originating from mobile     virtual devices. A remote attacker can exploit this to     crash the guest OS. (CVE-2012-3289)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - An error exists related to handling checkpoint files     that could allow memory corruption leading to arbitrary     code execution. (CVE-2012-3288)

  - An error exists related to handling mobile device     traffic data that could lead to denial of service     conditions. (CVE-2012-3289)

The VMware Workstation install detected on the remote host is 7.x earlier than 7.1.6, or 8.0.x earlier than 8.0.4 and is, therefore, potentially affected by the following vulnerabilities :

  - A memory corruption error exists related to the     handling of 'Checkpoint' files that can allow arbitrary     code execution. (CVE-2012-3288)

  - An error exists related to handling traffic from     remote physical devices, e.g. CD-ROM or mouse that     can cause the virtual machine to cash. Note that this     issue only affects the 8.x branch. (CVE-2012-3289)

The VMware Player install detected on the remote host is 3.x earlier than 3.1.6, or 4.0.x, earlier than 4.0.4 and is, therefore, potentially affected by the following vulnerabilities :

  - A memory corruption error exists related to the     handling of 'Checkpoint' files that can allow arbitrary     code execution. (CVE-2012-3288)

  - An error exists related to handling traffic from     remote physical devices, e.g. CD-ROM or mouse that     can cause the virtual machine to crash. Note that this     issue affects only the 4.x branch. (CVE-2012-3289)

a. VMware Host Checkpoint file memory corruption

   Input data is not properly validated when loading Checkpoint files.
   This may allow an attacker with the ability to load a specially    crafted Checkpoint file to execute arbitrary code on the host.

   Workaround
   - None identified

   Mitigation
   - Do not import virtual machines from untrusted sources.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-3288 to this issue.

b. VMware Virtual Machine Remote Device Denial of Service

   A device (e.g. CD-ROM, keyboard) that is available to a virtual    machine while physically connected to a system that does not run the    virtual machine is referred to as a remote device.

   Traffic coming from remote virtual devices is incorrectly handled.
   This may allow an attacker who is capable of manipulating the    traffic from a remote virtual device to crash the virtual machine.

   Workaround
   - None identified

   Mitigation
   - Users need administrative privileges on the virtual machine      in order to attach remote devices.
   - Do not attach untrusted remote devices to a virtual machine.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-3289 to this issue.

ID	Name	Product	Family	Severity
89036	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0011) (remote check)	Nessus	Misc.	high
70883	ESXi 5.0 < Build 721882 Multiple Vulnerabilities (remote check)	Nessus	Misc.	high
59730	VMware Workstation Multiple Vulnerabilities (VMSA-2012-0011)	Nessus	Windows	high
59729	VMware Player Multiple Vulnerabilities (VMSA-2012-0011)	Nessus	Windows	high
59506	VMSA-2012-0011 : VMware hosted products and ESXi and ESX patches address security issues	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2012-3289

high

Tenable Plugins

high

high

high

high

high