Tim Shelton has reported a vulnerability in VMware, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error in "vmnat.exe" (Windows) and "vmnet-natd" (Linux) when handling certain FTP requests. This can be exploited to cause a heap-based buffer overflow via specially crafted "eprt" and "port" FTP requests sent from the guest OS.

Successful exploitation allows arbitrary code execution on the host OS, but requires that NAT networking is enabled on the virtual machine.

The vulnerability has been reported in the following products:
* VMware Workstation 5.5 and prior.
* VMware GSX Server 3.2 and prior.
* VMware ACE 1.0.1 and prior.
* VMware Player 1.0 and prior.

Solution
Update to the latest versions.
Further details available in Customer Area

Provided and/or discovered by
Tim Shelton

Changelog
Further details available in Customer Area

Original Advisory
VMware:
http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=2000

Tim Shelton:
http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040442.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area