VMware patches software flaws
VMware has released updates to its hosted virtualization software products that shore up a variety of vulnerabilities.The flaws could allow attackers to execute arbitrary code on affected Microsoft Windows-based hosts.
One of the vulnerabilities impacts systems that enabled VMware's Virtual Machine Communication Interface (VMCI). VCMI is VMware's middleware that provides communication between a virtual machine and the host operating system and between two or more virtual machines on the same host.
An attacker can exploit this issue to execute arbitrary code with system-level privileges. As noted, this bug affects systems running on Windows hosts, according to VMware.
According to security researchers at Security Focus, an information-sharing site, exploiting this vulnerability can compromise affected computers while failed exploit attempts can lead to denial-of-service conditions that shut the affected system down.
The vulnerability affects VMware's Workstation prior to 6.0.4 build 93057, the VMware Player prior to 2.0.4 build 93057, and VMware ACE prior to 2.0.2 build 93057.
Another vulnerability that was patched, a heap buffer overflow that could allow a non-administrative guest process to execute code, requires the VMware system to be running with at least a single shared folder. Systems running the default setting are not vulnerable to this issue. VMware Server, ESX and ESXi do not provide the shared folders feature, so are not vulnerable.
