VMware Workstation 9.x before 9.0.1, VMware Player 5.x before 5.0.1, VMware Fusion 5.x before 5.0.1, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 allow guest OS users to cause a denial of service (VMX process disruption) by using an invalid port.

The remote VMware ESX / ESXi host is affected by multiple denial of service vulnerabilities :

    - A denial of service vulnerability exists due to a NULL       pointer deference flaw when handling Network File Copy       (NFC) traffic. An unauthenticated, remote attacker can       exploit this by intercepting and modifying the traffic       between the ESX / ESXi host and the client.
      (CVE-2014-1207)

    - A flaw exists due to improper handling of invalid       ports. An unauthenticated attacker on an adjacent       network can exploit this to cause VMX processing to       fail, resulting in a partial denial of service.
      (CVE-2014-1208)

The installed version of VMware Workstation 9.x is prior to 9.0.1. It is, therefore, affected by a denial of service vulnerability due to an issue with handling invalid ports that could allow a guest user to crash the VMX process.

The version of VMware Workstation installed on the remote host is version 9.x prior to 9.0.1.  It is, therefore, reportedly affected by a denial of service vulnerability due to an issue with handling invalid ports that could allow a guest user to crash the VMX process.

The installed version of VMware Player 5.x running on the remote Linux host is a version prior to 5.0.1.  It is, therefore, affected by a denial of service vulnerability due to an issue with handling invalid ports that could allow a guest user to crash the VMX process.

The installed version of VMware Player 5.x running on the remote Windows host is a version prior to 5.0.1.  It is, therefore, reportedly affected by a denial of service vulnerability due to an issue with handling invalid ports that could allow a guest user to crash the VMX process.

The remote VMware ESXi 5.1 host is affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the bundled     OpenSSL library that is triggered when handling OCSP     response verification. A remote attacker can exploit     this to crash the program. (CVE-2013-0166)

  - An error exists related to the SSL/TLS/DTLS protocols,     CBC mode encryption and response time. An attacker     can obtain plaintext contents of encrypted traffic via     timing attacks. (CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities that could allow     denial of service attacks. (CVE-2013-0338)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. An attacker can     exploit this by intercepting and modifying NFC traffic,     to cause a denial of service condition. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

The version of VMware Fusion 5.x installed on the remote Mac OS X host is prior to 5.0.1.  It is, therefore, reportedly affected by a denial of service vulnerability due to an issue with handling invalid ports that could allow a guest user to crash the VMX process.

a. VMware ESXi and ESX NFC NULL pointer dereference

      VMware ESXi and ESX contain a NULL pointer dereference in       the handling of the Network File Copy (NFC) traffic. To       exploit this vulnerability, an attacker must intercept and       modify the NFC traffic between ESXi/ESX and the client.        Exploitation of the issue may lead to a Denial of Service.

      To reduce the likelihood of exploitation, vSphere components        should be deployed on an isolated management network.
           VMware would like to thank Alex Chapman of Context Information       Security for reporting this issue to us.

      The Common Vulnerabilities and Exposures project (cve.mitre.org) has       assigned the name CVE-2014-1207 to this issue.

b. VMware VMX process denial of service vulnerability

      Due to a flaw in the handling of invalid ports, it is possible       to cause the VMX process to fail. This vulnerability may allow a       guest user to affect the VMX process resulting in a partial denial of       service on the host.

      VMware would like to thank Recurity Labs GmbH and the Bundesamt       Sicherheit in der Informationstechnik (BSI) for reporting this       issue to us

      The Common Vulnerabilities and Exposures project (cve.mitre.org) has       assigned the name CVE-2014-1208 to this issue.

c. VMware vCloud Director Cross Site Request Forgery (CSRF)

      VMware vCloud Director contains a vulnerability in the Hyper Text Transfer       Protocol (http) session management. An attacker may trick an authenticated       user to click a malicious link, which would result in the user being logged       out. The user is able to immediately log back into the system. 

      VMware would like to thank Mattia Folador for reporting this issue to us.

      The Common Vulnerabilities and Exposures project (cve.mitre.org) has       assigned the name CVE-2014-1211 to this issue.

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - Multiple errors exist related to OpenSSL that could     allow information disclosure or denial of service     attacks. (CVE-2013-0166, CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities. An attacker can     exploit this to cause a denial of service. (CVE-2013-0338)

  - An unspecified error exists related to 'hostd-vmdb'. An     attacker can exploit this to cause a denial of service.
    (CVE-2013-5970)

  - An error exists in the handling of certain Virtual     Machine file descriptors. This may allow an unprivileged     user with the 'Add Existing Disk' privilege to obtain     read and write access to arbitrary files, possibly     leading to arbitrary code execution after a host reboot.
    (CVE-2013-5973)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. This issue may lead     to a denial of service if an attacker intercepts and     modifies the NFC traffic. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

ID	Name	Product	Family	Type	Severity
87673	VMware ESX / ESXi Multiple DoS (VMSA-2014-0001)	Nessus	Misc.	Remote	medium
72041	VMware Workstation 9.x < 9.0.1 VMX Process DoS (VMSA-2014-0001) (Linux)	Nessus	General	Local	low
72040	VMware Workstation 9.x < 9.0.1 VMX Process DoS (VMSA-2014-0001)	Nessus	Windows	Local	low
72039	VMware Player 5.x < 5.0.1 VMX Process DoS (VMSA-2014-0001) (Linux)	Nessus	General	Local	low
72038	VMware Player 5.x < 5.0.1 VMX Process DoS (VMSA-2014-0001)	Nessus	Windows	Local	low
72037	ESXi 5.1 < Build 1483097 Multiple Vulnerabilities (remote check)	Nessus	Misc.	Remote	low
72036	VMware Fusion 5.x < 5.0.1 VMX Process DoS (VMSA-2014-0001)	Nessus	MacOS X Local Security Checks	Local	low
72006	VMSA-2014-0001 : VMware Workstation, Player, Fusion, ESXi, ESX and vCloud Director address several security issues	Nessus	VMware ESX Local Security Checks	Local	medium
70879	ESXi 5.0 < Build 1311175 Multiple Vulnerabilities (remote check)	Nessus	Misc.	Remote	medium

Detections

Analytics

CVE-2014-1208

high

Tenable Plugins

medium

low

low

low

low

low

low

medium

medium