Vmware Workstation/Player/Fusion/ESXi/ESX File buffer overflow

VulDB: Vmware Workstation/Player/Fusion/ESXi/ESX File buffer overflow

General

Vmware

scipID: 5563
Affected: Vmware Workstation/Player/Fusion/ESXi/ESX
Published: 06/14/2012 (Thorsten Tüllmann)
Risk: critical
Entry: 89.5% complete
Created: 06/21/2012
Updated: 09/03/2012

Summary

A vulnerability classified as critical was found in Vmware Workstation, Player, Fusion, ESXi and ESX. Affected by this vulnerability is an unknown function. The manipulation as part of a File leads to a buffer overflow vulnerability. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was presented 06/14/2012 by Thorsten Tüllmann as VMSA-2012-0011 as advisory (vmware.com). The advisory is shared for download at vmware.com. This vulnerability is known as CVE-2012-3288 since 06/07/2012. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 59730 (VMware Workstation Multiple Vulnerabilities (VMSA-2012-0011)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows and running in the context local.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at vmware.com. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at OSVDB (82979), Secunia (SA49430) and SecurityFocus (BID 53996).