CVE-2012-2449
published 2012-05-04CVE-2012-2449: VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through…
PriorityP342critical9CVSS 2.0
AVNACLAuSCCICAC
EPSS
2.51%
83.0th percentile
VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5h58-q44m-q85g: VMware Workstation 8
ghsa_unreviewed·2022-05-17
CVE-2012-2449 [HIGH] CWE-119 GHSA-5h58-q44m-q85g: VMware Workstation 8
VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.
VMware
VMware Workstation, Player, ESXi and ESX patches address critical security issues
vendor_vmware·2012-05-03·CVSS 9.9
CVE-2012-1516 [CRITICAL] VMware Workstation, Player, ESXi and ESX patches address critical security issues
VMSA-2012-0009: VMware Workstation, Player, ESXi and ESX patches address critical security issues
a. VMware host memory overwrite vulnerability (data pointers) Due to a flaw in the handler function for RPC commands, it is possible to manipulate data pointers within the VMX process. This vulnerability may allow a guest user to crash the VMX process or potentially execute code on the host.
CVEs: CVE-2012-1516, CVE-2012-1517, CVE-2012-2448, CVE-2012-2449, CVE-2012-2450
Affected products: ESXi, VMware Fusion, VMware Tools, VMware Workstation
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://osvdb.org/81694http://secunia.com/advisories/49032http://www.securityfocus.com/bid/53369http://www.securitytracker.com/id?1027019http://www.vmware.com/security/advisories/VMSA-2012-0009.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/75376https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863http://osvdb.org/81694http://secunia.com/advisories/49032http://www.securityfocus.com/bid/53369http://www.securitytracker.com/id?1027019http://www.vmware.com/security/advisories/VMSA-2012-0009.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/75376https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863
2012-05-04
Published