Title: VMware Hosted Products VMSA-2009-0005 Multiple Remote Vulnerabilities
Severity: CRITICAL
Description:
VMware hosted products are prone to multiple remote vulnerabilities:
1. A denial-of-service vulnerability occurs in the guest virtual device driver. An attacker can exploit this issue to cause the guest operating system to crash the host operating system, denying service to legitimate users. This issue affects VMware Workstation, Player, ACE, Server, Fusion, ESX, and ESXi. (CVE-2008-3761)
2. A denial-of-service vulnerability affects an unspecified IOCTL contained in the 'homon.sys' driver. An attacker can exploit this issue to cause a denial-of-service condition on a Windows-based host. This issue can be exploited only through a Windows-based account. This issue affects VMware Workstation, Player, ACE, and Server. (CVE-2009-1146)
3. A second denial-of-service vulnerability affects an unspecified IOCTL contained in the 'homon.sys' driver. An attacker can exploit this issue to cause a denial-of-service condition on a Windows-based host. This issue can be exploited only through a Windows-based account. This issue affects VMware Workstation, Player, ACE, and Server. (CVE-2008-3761)
4. A privilege-escalation vulnerability affects 'vmci.sys' driver on Windows-based machines. This issue affects both the Windows host machine and guest machine. Attackers can exploit this issue to gain elevated privileges on the host or the guest. This issue affects VMware Workstation, Player, ACE, and Server. (CVE-2009-1147)
5. Two heap-based buffer-overflow vulnerabilities occur in the VNnc Codec. An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious webpage or open a malicious video file. This issue affects VMware Workstation, Player, ACE, and Server. (CVE-2009-0909 and CVE-2009-0910).
The issue tracked by CVE-2009-0909 occurs when the RFB message type of one of the blocks in a stream is changed to any value greater than '0x03'.
The issue tracked by CVE-2009-0910 presents itself in the function responsible for handling 'ICM_DECOMPRESS' while decompressing a frame. The function uses the 'dwSize' element within an Open-DML standard index RIFF chunk as an argument to the 'memcpy' function.
6. An unauthorized-access vulnerability in ACE shared folder may allow attackers to enable previously disabled shared ACE folders. This issue affects VMware ACE. (CVE-2009-0908)
7. A remote denial-of-service vulnerability affects Windows-based hosts. An attacker can exploit this issue to crash the affected host, denying service to legitimate users. This issue affects VMware Workstation, Player, ACE, Server, and Fusion. (CVE-2009-0177)
8. An information-disclosure vulnerability affects VirtualCenter Server with VI Client enabled. Specifically, the password for the VirtualCenter Server is stored in memory and can be accessed by unauthorized users. This issue affects VMware ESX. (CVE-2009-0518)
Attackers can exploit these issues to crash the affected applications, execute arbitrary code, compromise the affected applications, gain unauthorized access, and obtain sensitive information. Other attacks are also possible.
Affected Products:
- VMWare ACE 1.0.0
- VMWare ACE 1.0.2
- VMWare ACE 1.0.2 Build 19206
- VMWare ACE 1.0.3
- VMWare ACE 1.0.4
- VMWare ACE 1.0.5
- VMWare ACE 1.0.5 build 79846
- VMWare ACE 1.0.7
- VMWare ACE 1.0.7 build 108880
- VMWare ACE 1.0.8 build 125922
- VMWare ACE 2.0.0
- VMWare ACE 2.0.1
- VMWare ACE 2.0.2
- VMWare ACE 2.0.2 build 93057
- VMWare ACE 2.0.3
- VMWare ACE 2.0.5
- VMWare ACE 2.0.5 build 109488
- VMWare ACE 2.5.0 build 118166
- VMWare ACE 2.5.1
- VMWare ESX Server 3.0.2
- VMWare ESX Server 3.0.3
- VMWare ESX Server 3.5
- VMWare ESXi Server 3.5
- VMWare Player 1.0.1 Build 19317
- VMWare Player 1.0.2
- VMWare Player 1.0.3
- VMWare Player 1.0.4
- VMWare Player 1.0.5
- VMWare Player 1.0.6
- VMWare Player 1.0.6 Build 80404
- VMWare Player 1.0.7 build 91707
- VMWare Player 1.0.8
- VMWare Player 1.0.8 build 108000
- VMWare Player 1.0.9 build 126128
- VMWare Player 2.0.0
- VMWare Player 2.0.1
- VMWare Player 2.0.2
- VMWare Player 2.0.3 Build 80004
- VMWare Player 2.0.4
- VMWare Player 2.0.4 build 93057
- VMWare Player 2.0.5
- VMWare Player 2.0.5 build 109488
- VMWare Player 2.5.0 build 118166
- VMWare Player 2.5.1
- VMWare Server 1.0.2
- VMWare Server 1.0.3
- VMWare Server 1.0.4
- VMWare Server 1.0.5
- VMWare Server 1.0.5 Build 80187
- VMWare Server 1.0.6
- VMWare Server 1.0.6 build 91891
- VMWare Server 1.0.7
- VMWare Server 1.0.7 build 108231
- VMWare Server 1.0.8 build 126538
- VMWare Workstation 6.0.1
- VMWare Workstation 6.0.2
- VMWare Workstation 6.0.3
- VMWare Workstation 6.0.3 Build 80004
- VMWare Workstation 6.0.4
- VMWare Workstation 6.0.4 build 93057
- VMWare Workstation 6.0.5
- VMWare Workstation 6.0.5 build 109488
- VMWare Workstation 6.5.0 build 118166
- VMWare Workstation 6.5.1
- VMWare Workstation for Linux
References:
- CVE: CVE-2008-3761
- CVE: CVE-2009-0177
- CVE: CVE-2009-0518
- CVE: CVE-2009-0908
- CVE: CVE-2009-0909
- CVE: CVE-2009-0910
- CVE: CVE-2009-1146
- CVE: CVE-2009-1147
- TippingPoint DVLabs: VMWare VMnc Codec Invalid RFB Message Type Heap Overflow Vulnerability
- TippingPoint DVLabs: VMWare VMnc Codec Open-DML Standard Index dwSize Heap Overflow Vulnerability
- VMware: VMware Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
