Vulnerabilities > CVE-2016-7084 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in VMWare Workstation Player and Workstation PRO

047910
CVSS 6.9 - MEDIUM
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
vmware
microsoft
CWE-119
nessus
exploit available

Summary

tpview.dll in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printing is enabled, allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (host OS memory corruption) via a JPEG 2000 image.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

descriptionVMware Workstation - vprintproxy.exe JPEG2000 Images Multiple Memory Corruptions. CVE-2016-7084. Dos exploit for Windows platform
fileexploits/windows/dos/40399.txt
idEDB-ID:40399
last seen2016-09-19
modified2016-09-19
platformwindows
port
published2016-09-19
reporterGoogle Security Research
sourcehttps://www.exploit-db.com/download/40399/
titleVMware Workstation - vprintproxy.exe JPEG2000 Images Multiple Memory Corruptions
typedos

Nessus

  • NASL familyWindows
    NASL idVMWARE_WORKSTATION_MULTIPLE_VMSA_2016_0014.NASL
    descriptionThe version of VMware Workstation installed on the remote host is 12.x prior to 12.5.0. It is, therefore, affected by multiple vulnerabilities : - A heap buffer overflow condition exists in Cortado ThinPrint due to improper validation of user-supplied input. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7081) - A memory corruption issue exists in Cortado Thinprint due to improper handling of specially crafted EMF files. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7082) - A memory corruption issue exists in Cortado Thinprint due to improper handling of TrueType fonts embedded in EMFSPOOL. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7083) - A memory corruption issue exists in Cortado Thinprint due to improper handling of specially crafted JPEG2000 images. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7084) - A flaw exits due to improper loading of some dynamic link library (DLL) files that allows an attacker to load a DLL file and thereby execute arbitrary code. (CVE-2016-7085) - A flaw exists in the Workstation installer due to insecure loading of executables. An attacker can exploit this, via a crafted application named
    last seen2020-06-01
    modified2020-06-02
    plugin id93521
    published2016-09-15
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93521
    titleVMware Workstation 12.x < 12.5.0 Multiple Vulnerabilities (VMSA-2016-0014)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(93521);
      script_version("1.8");
      script_cvs_date("Date: 2019/11/14");
    
      script_cve_id(
        "CVE-2016-7081",
        "CVE-2016-7082",
        "CVE-2016-7083",
        "CVE-2016-7084",
        "CVE-2016-7085",
        "CVE-2016-7086"
      );
      script_bugtraq_id(
        92934,
        92935,
        92940,
        92941
      );
      script_xref(name:"VMSA", value:"2016-0014");
    
      script_name(english:"VMware Workstation 12.x < 12.5.0 Multiple Vulnerabilities (VMSA-2016-0014)");
      script_summary(english:"Checks the VMware Workstation version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A virtualization application installed on the remote host is affected
    by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of VMware Workstation installed on the remote host is
    12.x prior to 12.5.0. It is, therefore, affected by multiple
    vulnerabilities :
    
      - A heap buffer overflow condition exists in Cortado
        ThinPrint due to improper validation of user-supplied
        input. An attacker on the guest can exploit this to
        cause a denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7081)
    
      - A memory corruption issue exists in Cortado Thinprint
        due to improper handling of specially crafted EMF files.
        An attacker on the guest can exploit this to cause a
        denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7082)
    
      - A memory corruption issue exists in Cortado Thinprint
        due to improper handling of TrueType fonts embedded in
        EMFSPOOL. An attacker on the guest can exploit this to
        cause a denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7083)
    
      - A memory corruption issue exists in Cortado Thinprint
        due to improper handling of specially crafted JPEG2000
        images. An attacker on the guest can exploit this to
        cause a denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7084)
    
      - A flaw exits due to improper loading of some dynamic
        link library (DLL) files that allows an attacker to load
        a DLL file and thereby execute arbitrary code.
        (CVE-2016-7085)
    
      - A flaw exists in the Workstation installer due to
        insecure loading of executables. An attacker can exploit
        this, via a crafted application named 'setup64.exe'
        inserted into the same directory as the installer, to
        execute arbitrary code. (CVE-2016-7086)");
      script_set_attribute(attribute:"see_also", value:"https://www.vmware.com/security/advisories/VMSA-2016-0014.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to VMware Workstation 12.5.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7086");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/09/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/09/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/09/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:workstation");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("vmware_workstation_detect.nasl");
      script_require_keys("SMB/Registry/Enumerated", "installed_sw/VMware Workstation");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("install_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    
    appname = 'VMware Workstation';
    
    install = get_single_install(app_name:appname, exit_if_unknown_ver:TRUE);
    version = install['version'];
    path = install['path'];
    
    fix = "12.5.0";
    
    if (version =~ "^12\." && ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
    {
      port = get_kb_item("SMB/transport");
      if (!port) port = 445;
    
      report =
        '\n  Path              : ' + path +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fix + '\n';
      security_report_v4(port:port, extra:report, severity:SECURITY_HOLE);
    }
    else audit(AUDIT_INST_PATH_NOT_VULN, appname, version, path);
    
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2016-0014.NASL
    descriptiona. VMware Workstation heap-based buffer overflow vulnerabilities via Cortado ThinPrint VMware Workstation contains vulnerabilities that may allow a windows -based virtual machine (VM) to trigger heap-based buffer overflows in the windows-based hypervisor running VMware workstation that the VM resides on. Exploitation of this issue may lead to arbitrary code execution in the hypervisor OS. Exploitation is only possible if virtual printing has been enabled in VMware Workstation. This feature is not enabled by default. VMware Knowledge Base article 2146810 documents the procedure for enabling and disabling this feature. VMware would like to thank E0DB6391795D7F629B5077842E649393 working with Trend Micro
    last seen2020-06-01
    modified2020-06-02
    plugin id93512
    published2016-09-15
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93512
    titleVMSA-2016-0014 : VMware ESXi, Workstation, Fusion, &amp; Tools updates address multiple security issues