CVE-2012-3569
published 2012-11-14CVE-2012-3569: Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other…
PriorityP265critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
47.72%
98.7th percentile
Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esxi | — | — |
| vmware | ovf_tool | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | vcenter_server | — | — |
| vmware | vmware_workstation | — | — |
| vmware | vsphere | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
| vmware | workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x54\x59 (push esp; pop ecx encoder prepend)
- →Detect exploit delivery by inspecting HTTP User-Agent for both 'VMware-client' and 'ovfTool' strings, which the Metasploit module checks for before serving the malicious OVF payload. ↗
- →Flag HTTP responses with Content-Type 'text/xml' served to VMware OVF Tool user-agents, as the exploit delivers the malicious OVF file via this content type. ↗
- →Monitor for requests to URLs ending in '.mf' from VMware OVF Tool clients, which is a behavioural indicator of OVF file parsing activity that accompanies exploit attempts. ↗
- →The exploit targets a 'call esp' gadget at 0x7852753d in MSVCR90.dll version 9.00.30729.4148 (installed with VMware OVF Tools 2.1); presence of this DLL version on a system indicates a vulnerable target. ↗
- →The vulnerability is triggered during parsing of a malformed OVF file; inspect OVF files for format string specifiers (e.g., %n, %x, %s) in fields that would appear in error messages. ↗
- →Post-exploitation, the Metasploit module auto-runs 'migrate -f'; monitor for unexpected process migration activity following vmware-ovftool.exe execution. ↗
- ·The exploit has only been tested on Windows XP SP3 with VMware OVF Tools 2.1 (installer: vmware-ovftool-2.1.0-467744-win-i386.msi); the ROP gadget address (0x7852753d) is specific to MSVCR90.dll 9.00.30729.4148 and will not be reliable on other OS/DLL versions. ↗
- ·The payload excludes bytes 0x00–0x08, 0x0b, 0x0c, 0x0e, 0x0f, 0x10–0x1f, 0x80–0xff, and 0x22 as bad characters; detection signatures based on shellcode byte patterns must account for this encoding constraint. ↗
- ·The browser-based variant (exploit-db 24460) requires the victim to open a URL served by the attacker's HTTP listener, while the file-based variant (exploit-db 24461) requires the victim to open a crafted .ovf file directly; detection strategies differ between the two delivery methods. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Hosted Products and OVF Tool address security issues
vendor_vmware·2012-11-08·CVSS 8.3
CVE-2012-3569 [HIGH] VMware Hosted Products and OVF Tool address security issues
VMSA-2012-0015: VMware Hosted Products and OVF Tool address security issues
a. VMware Workstation and Player Weak permissions on process threads vulnerability. Certain processes when created have weak security permissions assigned. It is possible to commandeer these process threads, which could result in Elevation of Privilege in the context of the host. VMware would like to thank Derek Soeder of Cylance, Inc. for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-5458 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Product Version Running on Replace with/ Apply Patch VMware Product vCenter Product Vers
GHSA
GHSA-8wg2-73cr-jv3q: Format string vulnerability in VMware OVF Tool 2
ghsa_unreviewed·2022-05-17
CVE-2012-3569 [HIGH] CWE-134 GHSA-8wg2-73cr-jv3q: Format string vulnerability in VMware OVF Tool 2
Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.
No detection rules found.
Exploit-DB
VMware OVF Tools - Format String (Metasploit) (2)
exploitdb·2013-02-12
CVE-2012-3569 VMware OVF Tools - Format String (Metasploit) (2)
VMware OVF Tools - Format String (Metasploit) (2)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'VMWare OVF Tools Format String Vulnerability',
'Description' => %q{
This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for
Windows. The vulnerability occurs when printing error messages while parsing a
a malformed OVF file. The module has been tested successfully with VMWare OVF Tools
2.1 on Windows XP SP3.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jeremy Brown', # Vulnerability discovery
'juan vazquez' # Metasploit Module
],
'References'
Exploit-DB
VMware OVF Tools - Format String (Metasploit) (1)
exploitdb·2013-02-06
CVE-2012-3569 VMware OVF Tools - Format String (Metasploit) (1)
VMware OVF Tools - Format String (Metasploit) (1)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'VMWare OVF Tools Format String Vulnerability',
'Description' => %q{
This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for
Windows. The vulnerability occurs when printing error messages while parsing a
a malformed OVF file. The module has been tested successfully with VMWare OVF Tools
2.1 on Windows XP SP3.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jeremy Brown', # Vulnerability discovery
'juan vazquez' # Metasploit Mo
Metasploit
VMWare OVF Tools Format String Vulnerability
metasploit
VMWare OVF Tools Format String Vulnerability
VMWare OVF Tools Format String Vulnerability
This module exploits a format string vulnerability in VMWare OVF Tools 2.1 for Windows. The vulnerability occurs when printing error messages while parsing a a malformed OVF file. The module has been tested successfully with VMWare OVF Tools 2.1 on Windows XP SP3.
No writeups or analysis indexed.
http://osvdb.org/87117http://packetstormsecurity.com/files/120101/VMWare-OVF-Tools-Format-String.htmlhttp://secunia.com/advisories/51240http://technet.microsoft.com/en-us/security/msvr/msvr13-002http://www.vmware.com/security/advisories/VMSA-2012-0015.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/79922http://osvdb.org/87117http://packetstormsecurity.com/files/120101/VMWare-OVF-Tools-Format-String.htmlhttp://secunia.com/advisories/51240http://technet.microsoft.com/en-us/security/msvr/msvr13-002http://www.vmware.com/security/advisories/VMSA-2012-0015.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/79922
2012-11-14
Published