The recent Conficker virus scare had me warning relatives to protect their PCs, while also simultaneously gloating about how lucky I am to not be affected, since I’m a Mac user. You could say it bordered on the obnoxious, and you’d be right.
But it looks like I may have to eat some humble pie now that a bug has been found in VMware Fusion that could potentially allow malicious code to be run on your Mac using a virtualized Windows machine as a conduit. Obviously, Windows is still the weak link here, but it doesn’t make your Apple machine any less vulnerable.
Luckily, the flaw was discovered by Immunity Inc. exploit researcher Kostya Kortchinsky, and not by some malicious hacker eager to steal your credit card information. The vulnerability allows the virtual machine display function to read and write code in the host operating system, including OS X. Kortchinsky demoed the flaw using a Vista machine running a guest OS of Windows XP, but said the flaw is just as easy to exploit in OS X running Fusion, though they hadn’t yet actually run live tests of such a scenario.
Not one to be caught slouching, VMware has already responded with an update to Fusion, version 2.0.4, to fix the bug and block the exploit. It’s a free update for all Fusion 2 owners.
Even if Windows is actually the conduit for the malicious code in this case, this is a good reminder that Macs are not invulnerable to attack, despite what we may sometimes think. There’s a variety of security software out there to consider, but as always, smart and safe usage is your best bet for avoiding most ills.