CVE-2012-2449
Vulnerability from cvelistv5
Published
2012-05-04 16:00
Modified
2024-08-06 19:34
Severity ?
Summary
VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.
References
cve@mitre.orghttp://osvdb.org/81694
cve@mitre.orghttp://secunia.com/advisories/49032
cve@mitre.orghttp://www.securityfocus.com/bid/53369
cve@mitre.orghttp://www.securitytracker.com/id?1027019
cve@mitre.orghttp://www.vmware.com/security/advisories/VMSA-2012-0009.html
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/75376
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863
Impacted products
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:34:25.469Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "81694",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/81694"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2012-0009.html"
          },
          {
            "name": "oval:org.mitre.oval:def:16863",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863"
          },
          {
            "name": "49032",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49032"
          },
          {
            "name": "53369",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/53369"
          },
          {
            "name": "vmware-esxserver-floppy-priv-esc(75376)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75376"
          },
          {
            "name": "1027019",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1027019"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-05-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-13T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "81694",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/81694"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2012-0009.html"
        },
        {
          "name": "oval:org.mitre.oval:def:16863",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863"
        },
        {
          "name": "49032",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49032"
        },
        {
          "name": "53369",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/53369"
        },
        {
          "name": "vmware-esxserver-floppy-priv-esc(75376)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75376"
        },
        {
          "name": "1027019",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1027019"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-2449",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "81694",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/81694"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2012-0009.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2012-0009.html"
            },
            {
              "name": "oval:org.mitre.oval:def:16863",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863"
            },
            {
              "name": "49032",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49032"
            },
            {
              "name": "53369",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/53369"
            },
            {
              "name": "vmware-esxserver-floppy-priv-esc(75376)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75376"
            },
            {
              "name": "1027019",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1027019"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-2449",
    "datePublished": "2012-05-04T16:00:00",
    "dateReserved": "2012-05-01T00:00:00",
    "dateUpdated": "2024-08-06T19:34:25.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-2449\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2012-05-04T16:55:01.543\",\"lastModified\":\"2017-12-14T02:29:03.653\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.\"},{\"lang\":\"es\",\"value\":\"VMware Workstation v8.x antes de v8.0.3, VMware Player v4.x antes de v4.0.3, VMware Fusion v4.x hasta v4.1.2, VMware ESXi v3.5 hasta v5.0 y VMware ESX v3.5 hasta v4.1 no configura correctamente el dispositivo de disco virtual, lo que permite a los usuarios invitados del sistema operativo causar una denegaci\u00f3n de servicio (operaci\u00f3n de escritura fuera de los l\u00edmites y la ca\u00edda del proceso VMX) o posiblemente ejecutar c\u00f3digo arbitrario en el sistema operativo anfitri\u00f3n mediante el aprovechamiento de privilegios de administrador en el sistema operativo invitado.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":9.0},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:workstation:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCE22BB0-F375-4883-BF6C-5A6369694EF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:workstation:8.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD913295-9302-425A-A9E1-B0DF76AD3069\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:workstation:8.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51B6CAE2-A396-40C8-8FF0-D9EC64D5C9A0\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:player:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"535E3D3C-76A5-405A-8F9D-21A86ED31D07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:player:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D09D7FB-78EE-4168-996D-FD3CF2E187BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:player:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"816F1646-A1C9-4E4A-BCE1-A34D00B51ABE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:fusion:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60234129-7F7F-49FA-A425-CDAB4D09AB23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:fusion:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4FB73EC4-F3CE-428B-BA40-47FB21181543\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:fusion:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"927863C2-5A61-4137-83AC-6CF3F2958941\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:fusion:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F74559CB-6E52-421F-88F3-739913C26C8E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:fusion:4.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4870DAA2-6670-47EF-BF74-6E39B92E75DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:fusion:4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70C64B80-4928-4ABA-AF4E-1977C252BAEE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAE88D8C-9CC3-46D1-9F26-290BC679F47E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:3.5:1:*:*:*:*:*:*\",\"matchCriteriaId\":\"58ED8AB4-0FDF-4752-B44E-56F58593CE41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13771B15-CD71-472A-BE56-718B87D5825D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.0:1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A4E41C0-31FA-47AA-A9BF-B9A6C1D44801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.0:2:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF016EE7-083A-4D62-A6D4-2807EB47B6DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.0:3:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F11844A-3C6C-4AA5-87DC-979AFF62867A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.0:4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC463653-A599-45CF-8EA9-8854D5C59963\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BDE707D-A1F4-4829-843E-F6633BB84D6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.1:1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DC5C2BF-6EC6-436F-A925-469E87249C8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:4.1:2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BCE5DA9-BB88-4169-B77C-40B1F98D511A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esxi:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2331236-2E9B-4B52-81EE-B52DEB41ACE5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFF29100-E124-4416-95CF-18B4246D43F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esx:3.5:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"37A5D726-3D38-44D5-B509-1B8B003903A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esx:3.5:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4DA3B20-A743-4F37-A095-65161FFBEB73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esx:3.5:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF7C3C65-BE63-407E-9CFD-E571025C3E79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC337BB7-9A45-4406-A783-851F279130EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:vmware:esx:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B6BA46F-4E8C-4B2A-AE92-81B9F1B4D56C\"}]}]}],\"references\":[{\"url\":\"http://osvdb.org/81694\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/49032\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/53369\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1027019\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2012-0009.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/75376\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16863\",\"source\":\"cve@mitre.org\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.