PT-2009-2879 · Vmware · Vmware Player+4

Publicado 2009-09-08 · Atualizado 2018-10-11 · CVE-2009-0199

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Movie Decoder versions prior to 6.5.3 build 185404 VMware Workstation versions prior to 6.5.3 build 185404 VMware Player versions prior to 2.5.3 build 185404 VMware ACE versions prior to 2.5.3 build 185404

Description The issue is related to a heap-based buffer overflow in the VMnc media codec. This could potentially allow remote attackers to execute arbitrary code via a video file with crafted dimensions, also referred to as framebuffer parameters.

Recommendations For VMware Movie Decoder versions prior to 6.5.3 build 185404, update to version 6.5.3 build 185404 or later. For VMware Workstation versions prior to 6.5.3 build 185404, update to version 6.5.3 build 185404 or later. For VMware Player versions prior to 2.5.3 build 185404, update to version 2.5.3 build 185404 or later. For VMware ACE versions prior to 2.5.3 build 185404, update to version 2.5.3 build 185404 or later.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-0199

Produtos afetados

Vmnc Media Codec

Vmware Ace

Vmware Movie Decoder

Vmware Player

Vmware Workstation

Referências · 9

• http://vmware.com/security/advisories/VMSA-2009-0012.html · Aviso do Fabricante
• http://lists.vmware.com/pipermail/security-announce/2009/000065.html · Correção
• http://secunia.com/secunia_research/2009-25 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0199 · Nota de Segurança
• http://secunia.com/advisories/34938 · Aviso do Fabricante
• http://securityfocus.com/archive/1/506286/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0199 · Nota
• http://securityfocus.com/bid/36290 · Nota
• http://vupen.com/english/advisories/2009/2553 · Aviso do Fabricante