Apple Thoughts: VMware Fusion Bug Potentially Opens Up Macs to Malicious Code

"The recent Conficker virus scare had me warning relatives to protect their PCs, while also simultaneously gloating about how lucky I am to not be affected, since I'm a Mac user. You could say it bordered on the obnoxious, and you'd be right. But it looks like I may have to eat some humble pie now that a bug has been found in VMware Fusion that could potentially allow malicious code to be run on your Mac using a virtualized Windows machine as a conduit. Obviously, Windows is still the weak link here, but it doesn't make your Apple machine any less vulnerable."

This is a good reminder that just because it is a Mac, it doesn't mean that it is safe. Especially if you are running Windows on your machine. The flaw in question was discovered by Immunity Inc. exploit researcher Kostya Kortchinsky, and it allows the virtual machine display function to read and write code in the host operating system.

According to the article "Kortchinsky demoed the flaw using a Vista machine running a guest OS of Windows XP, but said the flaw is just as easy to exploit in OS X running Fusion, though they hadn't yet actually run live tests of such a scenario." Luckily, VMware is on top of things and have posted a software update to fix the problem.

The AppleBlog did a comparison of four security programs from last fall for the Mac in case you are interested in checking out a few ways to protect your Mac.