Vulnerable Systems:
* VMWare Workstation
* VMWare Server
* VMWare Player
* VMWare ACE
Upon installation VMWare Workstation, Server, Player, and ACE register vmnc.dll as a video codec driver to handle compression and decompression of the fourCC type 'VMnc'. This format is used primarily by Workstation to capture remote framebuffer recordings of sessions within a virtual machine. The resulting video is stored within an AVI container file.
While playing back such files the function responsible for handling ICM_DECOMPRESS driver messages implicitly trusts a size value while decompressing a frame. An attacker can utilize this to miscalculate a destination pointer. This leads to the corruption of a heap buffer on a later call to memcpy with user-controlled source data. This can be leveraged to execute arbitrary code on the host system under the context of the current user.
