bugtraq - Re: Vm ware 0day dos exploit by n00b.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 19 Jun 2006 19:32:01 -0800
From: "Eliah Kagan" <degeneracypressure@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: Vm ware 0day dos exploit by n00b.

On 18 Jun 2006 13:02:01 -0000, co296@....com <co296@....com> wrote:
> Credit's : n00b
>
> email : co296@....com
>
> Erm was wondering if you could take a close look at this it is a 0day
> dos exploit by me i found tonight in vmware i have even debug for you
> guy's to take a look at.I hope you guy's will put it up after checking
> through it.Ok the first thing is vmware use's.vmx file's as like config file's
>
> the problem as follows in vmx file's we have to change the name of our
> file.iso
>
> Following line's ide1:0.fileName =
>
> but if wee change it to the following it will cause a d0s and vmware will
> have to be shut down and rebooted.The file has an overly long file name
> as follows
[snip]

Anyone with access to the .vmx config file for a virtual machine has
control over that virtual machine and is unavoidably able to make it
fail in a number of other ways. A user could attempt to boot a
3rd-party virtual machine with a specially crafted .vmx file while
running other (potentially mission-critical) virtual machines, and in
crashing VMware would terminate those other virtual
machines--consequently this is a quite legitimate security issue,
albeit a non-critical one (as the generally accepted practice of not
running noncritical applications alongside critical ones prevents
exploitation, and DoS of a virtualization environment pending
application restart is far short of a disastrous condition). However,
do you (or does anyone) know if it is possible to make a specially
crafted .vmx file along similar lines to exploit this buffer overflow
in such a way as to execute arbitrary code as the user running VMware?
If that were possible, that would make this vulnerability much more
critical.

-Eliah