VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior to 12.0 and 11.x prior to 11.5.7) and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

The version of VMware Workstation installed on the remote host is 15.0.x prior to 15.5.7. It is, therefore, affected by a vulnerability.  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.0.x prior to 11.5.7. It is, therefore, affected by a vulnerability.  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote VMware ESXi host is version 7.0. It is, therefore, affected by a DoS vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware Workstation installed on the remote host is 15.x prior to 15.5.7. It is, therefore, affected by a DoS vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.x prior to 11.5.7. It is, therefore, affected by a DoS vulnerability due to improper input validation in GuestInfo. A malicious actor with normal user privilege access to a virtual machine can crash the virtual machine's vmx process leading to a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
150961	VMware Workstation 15.0.x < 15.5.7 Vulnerability (VMSA-2020-0029.1)	Nessus	General	Local	medium
150960	VMware Fusion 11.0.x < 11.5.7 Vulnerability (VMSA-2020-0029.1)	Nessus	MacOS X Local Security Checks	Local	medium
145090	ESXi 7.0 DoS (VMSA-2020-0029)	Nessus	Misc.	Remote	medium
144852	VMware Workstation 15.x < 15.5.7 DoS (VMSA-2020-0029)	Nessus	General	Local	medium
144851	VMware Fusion 11.x < 11.5.7 DoS (VMSA-2020-0029)	Nessus	MacOS X Local Security Checks	Local	medium

Detections

Analytics

CVE-2020-3999

medium

Tenable Plugins

medium

medium

medium

medium

medium