Skip to main content

VMware security advisory update: Critical memory corruption vulnerability

DoD guys and all the other folks who are building expertise around the security which they have gained while building a secured VMware environment by design, are also being exposed to the ones that can play potential havoc in your environments, should you not take security into account when designing and operating your virtual environments.

Ask yourself the following:

  • Do you know that such malicious attacks are not taking place in your environment?
  • Do you know if there is some sort of control in your environments?
  • How many of you have successfully deployed a CCP that makes your ESX complaint or atleast anywhere close to being SOX/PCI DSS 1.x standards? You must be able to control, authorize and demonstrate on your sense of control on these environments, can you do it?
  • Are you doing any sort of assessments in your environments, especially Virtual Infrastructures be it Oracle VM, VMware ESX, Citrix Xen, Xen or whatever?
  • Are some or any of your virtual platforms registered within your centralized directory, any LDAP v3 variants such as ADS etc?
Don't ignore the issues as they will come haunting you in some form or the other. Anyways, here's the advisory.

3. Problem Description

a. Critical Memory corruption vulnerability

A memory corruption condition may occur in the virtual machine
hardware. A malicious request sent from the guest operating
system to the virtual hardware may cause the virtual hardware to
write to uncontrolled physical memory.

VMware would like to thank Andrew Honig of the Department of
Defense for reporting this issue.

The Common Vulnerabilities and Exposures project (
has assigned the name CVE-2008-4917 to this issue.

The following table lists what action remediates the vulnerability
(column 4) if a solution is available.

VMware Product Running Replace with/
Product Version on Apply Patch
============= ======== ======= =================
VirtualCenter any Windows not affected

Workstation 6.5.x any not affected
Workstation 6.0.x any 6.5.0 build 118166 or later
Workstation 5.x any 5.5.9 build 126128 or later

Player 2.5.x any not affected
Player 2.0.x any 2.5.0 build 118166 or later
Player 1.x any 1.0.9 build 126128 or later

ACE 2.5.x Windows not affected
ACE 2.0.x Windows 2.5.0 build 118166 or later
ACE 1.x Windows 1.0.8 build 125922 or later

Server 2.x any not affected
Server 1.x any 1.0.8 build 126538 or later

Fusion 2.x Mac OS/X not affected
Fusion 1.x Mac OS/X upgrade to Fusion 2.0 or later

ESXi 3.5 ESXi ESXe350-200811401-O-SG

ESX 3.5 ESX ESX350-200811401-SG
ESX 3.0.3 ESX ESX303-200811401-BG
ESX 3.0.2 ESX ESX-1006980
ESX 2.5.5 ESX not affected

VMware Security Lists


Popular posts from this blog

Security: VMware Workstation 6 vulnerability

vulnerable software: VMware Workstation 6.0 for Windows, possible some other VMware products as well type of vulnerability: DoS, potential privilege escalation I found a vulnerability in VMware Workstation 6.0 which allows an unprivileged user in the host OS to crash the system and potentially run arbitrary code with kernel privileges. The issue is in the vmstor-60 driver, which is supposed to mount VMware images within the host OS. When sending the IOCTL code FsSetVoleInformation with subcode FsSetFileInformation with a large buffer and underreporting its size to at max 1024 bytes, it will underrun and potentially execute arbitrary code. Security focus

Cloud Security: Eliminate humans from the "Information Supply Chain on the Web"

My upcoming article, part - 3 data center predictions for 2009, has a slideshot talking about the transition from the current age to the cloud computing age to eventually the ideation age- the age where you will have clouds that will emote but they will have no internal employees. Biggest management disasters occur because internal folks are making a mess of the playground. Om's blog is carrying an article about Cloud security and it is rather direct but also makes a lot of sense: I don’t believe that clouds themselves will cause the security breaches and data theft they anticipate; in many ways, clouds will result in better security. Here’s why: Fewer humans – Most computer breaches are the result of human error ; only 20-40 percent stem from technical malfunctions. Cloud operators that want to be profitable take humans out of the loop whenever possible. Better tools – Clouds can afford high-end data protection and security monitoring tools, as well as the experts to run t