Test ID:	1.3.6.1.4.1.25623.1.0.103495
Category:	VMware Local Security Checks
Title:	VMware ESXi/ESX patches address security issues (VMSA-2012-0011)
Summary:	The remote ESXi is missing one or more security related Updates from VMSA-2012-0011.
Description:	Summary: The remote ESXi is missing one or more security related Updates from VMSA-2012-0011. Vulnerability Insight: a. VMware Host Checkpoint file memory corruption Input data is not properly validated when loading Checkpoint files. This may allow an attacker with the ability to load a specially crafted Checkpoint file to execute arbitrary code on the host. b. VMware Virtual Machine Remote Device Denial of Service A device (e.g. CD-ROM, keyboard) that is available to a virtual machine while physically connected to a system that does not run the virtual machine is referred to as a remote device. Traffic coming from remote virtual devices is incorrectly handled. This may allow an attacker who is capable of manipulating the traffic from a remote virtual device to crash the virtual machine. Affected Software/OS: ESXi 5.0 without patch ESXi500-201206401-SG ESXi 4.1 without patch ESXi410-201206401-SG ESXi 4.0 without patch ESXi400-201206401-SG ESXi 3.5 without patch ESXe350-201206401-I-SG ESX 4.1 without patch ESX410-201206401-SG ESX 4.0 without patch ESX400-201206401-SG ESX 3.5 without patch ESX350-201206401-SG Solution: Apply the missing patch(es). a. VMware Host Checkpoint file memory corruption Workaround - None identified Mitigation - Do not import virtual machines from untrusted sources. b. VMware Virtual Machine Remote Device Denial of Service Workaround - None identified Mitigation - Users need administrative privileges on the virtual machine in order to attach remote devices. - Do not attach untrusted remote devices to a virtual machine. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2012-3288 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17178 Common Vulnerability Exposure (CVE) ID: CVE-2012-3289
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.