KLA10452 Multiple vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware products. Malicious users can exploit these vulnerabilities to gain privileges or cause denial of service.

Below is a complete list of vulnerabilities

1. Vectors related to file write can be exploited locally;
2. Improper input validation can be exploited locally;
3. An obsolete version of SSL can be exploited remotely;
4. An obsolete version of libxml2 can be exploited remotely.

Original advisories

VMSA

Exploitation

Public exploits exist for this vulnerability.

Related products

VMware-Workstation

VMware-Player

VMware-Server

VMware-vCenter-Converter-Standalone

VMware-vSphere-Client

VMware-Fusion

CVE list

CVE-2014-3566 warning

CVE-2014-3568 warning

CVE-2014-3660 warning

CVE-2015-1043 warning

CVE-2015-1044 warning

CVE-2014-3513 high

CVE-2014-3567 high

CVE-2014-8370 high

Solution

Update to latest version

Get VMware products

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• LoI

Loss of integrity. Exploitation of vulnerabilities with this impact can lead to partial system fault or system components connection disruption.

Affected Products

• VMware Workstation 10 versions earlier than 10.0.5VMware Player 6 versions earlier than 6.0.5VMware Fusion 7 versions earlier than 7.0.1VMware Fusion 6 versions earlier than 6.0.5VMware vCenter Server 5.5 earlier than update 2dESXi 5.5 without patch ESXi550-201403102-SG, ESXi550-201501101-SGESXi 5.1 without patch ESXi510-201404101-SGESXi 5.0 without patch ESXi500-201405101-SG