ID: IRCNE2012061528
Date: 2012-06-19
According to "techworld", VMware has released security patches for its Workstation, Player, Fusion, ESXi and ESX products in order to address two vulnerabilities that could allow attackers to compromise the host system or crash a virtual machine.
The more serious vulnerability is identified as CVE-2012-3288 and stems from an improper validation of input data when loading virtual machine checkpoint files, the virtualisation said in a security advisory.
Attackers could exploit this validation error by loading specially crafted checkpoint files to trigger a memory corruption and potentially execute arbitrary code on the host system.
VMware advised customers to upgrade to the newly released Workstation 8.0.4, Player 4.0.4 and Fusion 4.1.3 or to install the patches available for their respective versions of ESXi and ESX. Customers should also avoid importing virtual machines from untrusted sources, the company said.
The second vulnerability addressed by the new security updates could allow attackers to crash a virtual machine by sending malformed traffic from a remote virtual device. Users are advised not to attach untrusted remote devices to virtual machines, the company said.
- 3