VMware Fusion < 2.0.6 (VMSA-2009-0013)

high Nessus Plugin ID 41971

Synopsis

The remote host has an application that is affected by two security issues.

Description

The version of VMware Fusion installed on the Mac OS X host is earlier than 2.0.6. Such versions are affected by two security issues :

- A vulnerability in the vmx86 kernel extension allows an unprivileged userland program to initialize several function pointers via the '0x802E564A' IOCTL code, which can lead to arbitrary code execution in the kernel context. (CVE-2009-3281)

- An integer overflow in the vmx86 kernel extension allows for a denial of service of the host by an unprivileged local user. (CVE-2009-3282)

Solution

Upgrade to VMware Fusion 2.0.6 or later.

See Also

http://lists.vmware.com/pipermail/security-announce/2009/000066.html

http://www.securityfocus.com/advisories/18019

http://www.securityfocus.com/archive/1/506891

http://www.securityfocus.com/archive/1/506893

Plugin Details

Severity: High

ID: 41971

File Name: macosx_fusion_2_0_6.nasl

Version: 1.12

Type: local

Agent: macosx

Published: 10/2/2009

Updated: 7/14/2018

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:vmware:fusion

Required KB Items: MacOSX/Fusion/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/2/2009

Vulnerability Publication Date: 10/2/2009

Exploitable With

Core Impact

Reference Information

CVE: CVE-2009-3281, CVE-2009-3282

BID: 36578, 36579

CWE: 189, 264