VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

The version of VMware Workstation installed on the remote Windows host is 10.x prior to 10.0.5. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists that allows a local attacker     to escalate privileges or cause a denial of service     via an arbitrary write to a file. (CVE-2014-8370)

  - An input validation error exists in the Host Guest File     System (HGFS) that allows a local attacker to cause a     denial of service of the guest operating system.
    (CVE-2015-1043)

  - An input validation error exists in the VMware     Authorization process (vmware-authd) that allows a     remote attacker to cause a denial of service of the host     operating system. (CVE-2015-1044)

  - A denial of service vulnerability exists due to improper     validation of user-supplied input to a remote procedure     call (RPC) command. An unauthenticated, remote attacker     can exploit this, via a crafted command, to crash the     host or guest operating systems. (CVE-2015-2341)

The version of VMware Workstation installed on the remote host is version 10.x prior to 10.0.5. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists that allows a local attacker     to escalate privileges or cause a denial of service     via an arbitrary write to a file. (CVE-2014-8370)

  - An input validation error exists in the Host Guest File     System (HGFS) that allows a local attacker to cause a     denial of service of the guest operating system.
    (CVE-2015-1043)

  - An input validation error exists in the VMware     Authorization process (vmware-authd) that allows a     remote attacker to cause a denial of service of the host     operating system. (CVE-2015-1044)

The version of VMware Player installed on the remote host is version 6.x prior to 6.0.5. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists that allows a local attacker     to escalate privileges or cause a denial of service     via an arbitrary write to a file. (CVE-2014-8370)

  - An input validation error exists in the Host Guest File     System (HGFS) that allows a local attacker to cause a     denial of service of the guest operating system.
    (CVE-2015-1043)

  - An input validation error exists in the VMware     Authorization process (vmware-authd) that allows a     remote attacker to cause a denial of service of the host     operating system. (CVE-2015-1044)

The version of VMware Fusion installed on the remote Mac OS X host is version 6.x prior to 6.0.5 or version 7.x prior to 7.0.1. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists that allows a local attacker     to escalate privileges or cause a denial of service     via an arbitrary write to a file. (CVE-2014-8370)

  - An input validation error exists in the Host Guest File     System (HGFS) that allows a local attacker to cause a     denial of service of the guest operating system.
    (CVE-2015-1043)

The remote VMware ESXi host is version 5.5 prior to build 2352327. It is, therefore, affected by the following vulnerabilities :

  - An error exists related to DTLS SRTP extension handling     and specially crafted handshake messages that can allow     denial of service attacks via memory leaks.
    (CVE-2014-3513)

  - An error exists related to the way SSL 3.0 handles     padding bytes when decrypting messages encrypted using     block ciphers in cipher block chaining (CBC) mode. A     man-in-the-middle attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections. This     is also known as the 'POODLE' issue. (CVE-2014-3566)

  - An error exists related to session ticket handling that     can allow denial of service attacks via memory leaks.
    (CVE-2014-3567)

  - An error exists related to the build configuration     process and the 'no-ssl3' build option that allows     servers and clients to process insecure SSL 3.0     handshake messages. (CVE-2014-3568)

  - A denial of service vulnerability in libxml2 due to     entity expansion even when entity substitution is     disabled. A remote attacker, using a crafted XML     document containing  larger number of nested entity     references, can cause the consumption of CPU resources.
    (CVE-2014-3660)

  - An unspecified privilege escalation vulnerability.
    (CVE-2014-8370)

  - An unspecified denial of service vulnerability due to an     input validation issue in the VMware Authorization     process (vmware-authd). (CVE-2015-1044)

The remote VMware ESXi host is version 5.1 prior to build 1743201. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the monlist feature in NTP. A remote     attacker can exploit this flaw, using a specially     crafted packet to load the query function in monlist, to     conduct a distributed denial of service attack.
    (CVE-2013-5211)

  - An unspecified privilege escalation vulnerability exists     that allows an attacker to gain host OS privileges or     cause a denial of service condition by modifying a     configuration file. (CVE-2014-8370)

  - A flaw exists in the VMware Authorization process     (vmware-authd) due to improper validation of     user-supplied input. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-1044)

The remote VMware ESXi host is version 5.0 prior to build 1749766. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the monlist feature in NTP. A remote     attacker can exploit this flaw, using a specially     crafted packet to load the query function in monlist, to     conduct a distributed denial of service attack.
    (CVE-2013-5211)

  - An unspecified privilege escalation vulnerability exists     that allows an attacker to gain host OS privileges or     cause a denial of service condition by modifying a     configuration file. (CVE-2014-8370)

a. VMware ESXi, Workstation, Player, and Fusion host privilege    escalation vulnerability

   VMware ESXi, Workstation, Player and Fusion contain an arbitrary    file write issue. Exploitation this issue may allow for privilege    escalation on the host.

   The vulnerability does not allow for privilege escalation from    the guest Operating System to the host or vice-versa. This means    that host memory can not be manipulated from the Guest Operating    System.

   Mitigation

   For ESXi to be affected, permissions must have been added to ESXi    (or a vCenter Server managing it) for a virtual machine    administrator role or greater.

   VMware would like to thank Shanon Olsson for reporting this issue to    us through JPCERT.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifier CVE-2014-8370 to this issue.

b. VMware Workstation, Player, and Fusion Denial of Service    vulnerability

   VMware Workstation, Player, and Fusion contain an input    validation issue in the Host Guest File System (HGFS).
   This issue may allow for a Denial of Service of the Guest    Operating system.

   VMware would like to thank Peter Kamensky from Digital    Security for reporting this issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifier CVE-2015-1043 to this issue.

c. VMware ESXi, Workstation, and Player Denial of Service    vulnerability

   VMware ESXi, Workstation, and Player contain an input    validation issue in VMware Authorization process (vmware-authd).
   This issue may allow for a Denial of Service of the host. On    VMware ESXi and on Workstation running on Linux the Denial of    Service would be partial.

   VMware would like to thank Dmitry Yudin @ret5et for reporting    this issue to us through HP's Zero Day Initiative.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifier CVE-2015-1044 to this issue.

d. Update to VMware vCenter Server and ESXi for OpenSSL 1.0.1    and 0.9.8 package

   The OpenSSL library is updated to version 1.0.1j or 0.9.8zc    to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2014-3513, CVE-2014-3567,    CVE-2014-3566 (&igrave;POODLE&icirc;) and CVE-2014-3568 to these issues.

e. Update to ESXi libxml2 package

   The libxml2 library is updated to version libxml2-2.7.6-17    to resolve a security issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2014-3660 to this issue.

ID	Name	Product	Family	Type	Severity
81187	VMware Workstation 10.x < 10.0.5 Multiple Vulnerabilities (VMSA-2015-0001 / VMSA-2015-0004) (Windows)	Nessus	Windows	Local	medium
81186	VMware Workstation 10.x < 10.0.5 Multiple Vulnerabilities (VMSA-2015-0001) (Linux)	Nessus	General	Local	critical
81185	VMware Player 6.x < 6.0.5 Multiple Vulnerabilities (VMSA-2015-0001) (Windows)	Nessus	Windows	Local	medium
81184	VMware Player 6.x < 6.0.5 Multiple Vulnerabilities (VMSA-2015-0001) (Linux)	Nessus	General	Local	medium
81183	VMware Fusion 6.x < 6.0.5 / 7.x < 7.0.1 Multiple Vulnerabilities (VMSA-2015-0001)	Nessus	MacOS X Local Security Checks	Local	medium
81085	ESXi 5.5 < Build 2352327 Multiple Vulnerabilities (remote check) (POODLE)	Nessus	Misc.	Remote	low
81084	ESXi 5.1 < Build 1743201 Multiple Vulnerabilities (remote check)	Nessus	Misc.	Remote	medium
81083	ESXi 5.0 < Build 1749766 Multiple Vulnerabilities (remote check)	Nessus	Misc.	Remote	medium
81079	VMSA-2015-0001 : VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues (POODLE)	Nessus	VMware ESX Local Security Checks	Local	low

Detections

Analytics

CVE-2014-8370

high

Tenable Plugins

medium

critical

medium

medium

medium

low

medium

medium

low