VMware Tools 11.x / 12.x < 12.5.3 / 13.x < 13.0.1.0 vSockets Information Disclosure (VMSA-2025-0013)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(247827);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/11");

  script_cve_id("CVE-2025-41239");
  script_xref(name:"VMSA", value:"2025-0013");

  script_name(english:"VMware Tools 11.x / 12.x < 12.5.3 / 13.x < 13.0.1.0 vSockets Information Disclosure (VMSA-2025-0013)");

  script_set_attribute(attribute:"synopsis", value:
"The virtualization tool suite is installed on the remote Windows host is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of VMware Tools installed on the remote Windows host is 11.x, 12.x prior to 12.5.3, or 13.x prior to
13.0.1.0. It is, therefore, affected by an information disclosure vulnerbility:

  - VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage
    of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine
    may be able to exploit this issue to leak memory from processes communicating with vSockets. (CVE-2025-41239)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35877
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?98207605");
  script_set_attribute(attribute:"solution", value:
"Upgrade to VMware Tools version 12.5.3 or 13.0.1.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-41239");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:tools");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vmware_tools_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/VMware Tools");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'VMware Tools', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {'min_version':'11.0', 'fixed_version': '12.4.8', 'fixed_display':'12.5.3'},
        {'min_version':'12.5', 'fixed_version': '12.5.3'},
        {'min_version':'13.0', 'fixed_version': '13.0.1.0'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);