PT-2009-3497 · Vmware · Vmware Server+3

Aaron Portnoy · Publicado 2009-04-06 · Atualizado 2017-09-29 · CVE-2009-0909

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 6.5.x before 6.5.2 build 156735 VMware Player versions 2.5.x before 2.5.2 build 156735 VMware ACE versions 2.5.x before 2.5.2 build 156735 VMware Server versions 2.0.x before 2.0.1 build 156745

Description A heap-based buffer overflow in the VNnc Codec allows remote attackers to execute arbitrary code via a crafted web page or video file.

Recommendations For VMware Workstation versions 6.5.x before 6.5.2 build 156735, update to version 6.5.2 build 156735 or later. For VMware Player versions 2.5.x before 2.5.2 build 156735, update to version 2.5.2 build 156735 or later. For VMware ACE versions 2.5.x before 2.5.2 build 156735, update to version 2.5.2 build 156735 or later. For VMware Server versions 2.0.x before 2.0.1 build 156745, update to version 2.0.1 build 156745 or later.

Exploit

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-0909

Produtos afetados

Vmware Ace

Vmware Player

Vmware Server

Vmware Workstation

Referências · 10

• 🔥 http://securityfocus.com/bid/34373 · Exploit
• http://securitytracker.com/id?1021974 · Nota
• http://vupen.com/english/advisories/2009/0944 · Nota
• http://seclists.org/fulldisclosure/2009/Apr/0036.html · Correção
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6251 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0909 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0909 · Nota de Segurança
• http://lists.vmware.com/pipermail/security-announce/2009/000054.html · Aviso do Fabricante
• http://vmware.com/security/advisories/VMSA-2009-0005.html · Nota