1. CVE-Search
  2. CVE-2012-2450
ID CVE-2012-2450
Summary VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.
References
Vulnerable Configurations
  • cpe:2.3:a:vmware:workstation:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:8.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:8.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:8.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:4.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:4.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:4.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:4.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:fusion:4.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:fusion:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:fusion:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:fusion:4.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:fusion:4.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:fusion:4.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:fusion:4.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:fusion:4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:fusion:4.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:fusion:4.1.1:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:3.5:1:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:3.5:1:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.0:1:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.0:1:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.0:2:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.0:2:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.0:3:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.0:3:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.0:4:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.0:4:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.1:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.1:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.1:1:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.1:1:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:4.1:2:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:4.1:2:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esxi:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esxi:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.5:update1:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.5:update1:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.5:update2:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.5:update2:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.5:update3:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.5:update3:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:4.1:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:4.1:*:*:*:*:*:*:*
CVSS
Base: 9.0 (as of 14-12-2017 - 02:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:S/C:C/I:C/A:C
oval via4
accepted 2013-07-29T04:00:54.353-04:00
class vulnerability
contributors
name Maria Kedovskaya
organization ALTX-SOFT
definition_extensions
  • comment VMware Workstation is installed
    oval oval:org.mitre.oval:def:16277
  • comment VMware Player is installed
    oval oval:org.mitre.oval:def:17194
description VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.
family windows
id oval:org.mitre.oval:def:16852
status accepted
submitted 2013-06-20T10:26:26.748+04:00
title VMware SCSI device unchecked memory write
version 6
refmap via4
bid 53369
confirm http://www.vmware.com/security/advisories/VMSA-2012-0009.html
osvdb 81695
sectrack 1027019
secunia 49032
xf esxserver-scsi-priv-esc(75377)
Last major update 14-12-2017 - 02:29
Published 04-05-2012 - 16:55
Last modified 14-12-2017 - 02:29
Back to Top