6.0.1

Threats Associated with Unprivileged User Accounts
Disk shrinking feature
Shrinking a virtual disk reclaims unused disk space. Users and processes
without root or administrator privileges can invoke this procedure. Because
the disk-shrinking process can take considerable time to complete, invoking
the disk-shrinking procedure repeatedly can cause a denial of service. The
virtual disk is unavailable during the shrinking process. Use the
following .vmx settings to disable disk shrinking:
isolation.tools.diskWiper.disable = "TRUE"
isolation.tools.diskShrink.disable = "TRUE"
Copy and paste feature
By default, the ability to copy and paste text, graphics, and files is disabled,
as is the ability to drag and drop files. When this feature is enabled, you can
copy and paste rich text and, depending on the VMware product, graphics
and files from your clipboard to the guest operating system in a virtual
machine. That is, as soon as the console window of a virtual machine gains
focus, nonprivileged users and processes running in the virtual machine can
access the clipboard on the computer where the console window is running.
To avoid risks associated with this feature, retain the following .vmx settings,
which disable copying and pasting:
isolation.tools.copy.disable = "TRUE"
isolation.tools.paste.disable = "TRUE"
Threats Associated with Virtual Devices
Connecting and
modifying devices
By default, the ability to connect and disconnect devices is disabled. When
this feature is enabled, users and processes without root or administrator
privileges can connect devices such as network adapters and CD-ROM
drives, and they can modify device settings. That is, a user can connect a
disconnected CD-ROM drive and access sensitive information on the media
left in the drive. A user can also disconnect a network adapter to isolate the
virtual machine from its network, which is a denial of service. To avoid risks
associated with this feature, retain the following .vmx settings, which disable
the ability to connect and disconnect devices or to modify device settings:
isolation.device.connectable.disable = "TRUE"
isolation.device.edit.disable = "TRUE"
Threats Associated with Virtual Machine Information Flow
Configuring virtual
machine log number
Depending on your log settings, new log files might be created each time the
old file is larger than 100KB. Uncontrolled logging can lead to denial of
service if the datastore runs out of disk space. VMware recommends saving
10 log files. By default, the maximum size for log files is 100KB, and you
cannot change that value at the virtual machine level. Use the following .vmx
setting to set number of log files:
vmx.log.keepOld = "10"
vSphere Virtual Machine Administration
210 VMware, Inc.