VMware fixes vulnerabilities

[Humpty]

Virtualisation software vendor VMware has released numerous product updates which fix vulnerabilities in almost all the products in their portfolio. Attackers can exploit these vulnerabilities to, for example, break out of the guest system in the virtual machine or terminate processes on the host system. The VMware security advisory lists a total of 20 entries in the Common Vulnerabilities and Exposures (CVE) database which relate to security vulnerabilities fixed by the new versions.

 

Particularly critical are the vulnerabilities which enable attackers or malicious software to break out of the virtual machine. From an account with administrator privileges on a guest system, attackers can manipulate the memory of host processes leading to execution of injected malicious code. It is also possible to crash processes on the host system. In the integrated DHCP server, crafted packets may allow access with SYSTEM privileges.

Article