PT-2010-2854 · Vmware · Vmware Server+4

Publicado 2010-04-12 · Atualizado 2013-05-15 · CVE-2010-1138

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 7.0 through 7.0.0 VMware Workstation version 6.5.x through 6.5.3 VMware Player versions 3.0 through 3.0.0 VMware Player version 2.5.x through 2.5.3 VMware ACE versions 2.6 through 2.6.0 and 2.5.x through 2.5.3 VMware Server version 2.x VMware Fusion versions 3.0 through 3.0.0 and 2.x through 2.0.6

Description The virtual networking stack allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process.

Recommendations For VMware Workstation version 7.0, update to version 7.0.1 build 227600 or later. For VMware Workstation version 6.5.x, update to version 6.5.4 build 246459 or later. For VMware Player version 3.0, update to version 3.0.1 build 227600 or later. For VMware Player version 2.5.x, update to version 2.5.4 build 246459 or later. For VMware ACE versions 2.6 and 2.5.x, update to version 2.6.1 build 227600 or later and 2.5.4 build 246459 or later respectively. For VMware Server version 2.x, no specific fix is provided. For VMware Fusion versions 3.0 and 2.x, update to version 3.0.1 build 232708 or later and 2.0.7 build 246742 or later respectively.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2010-1138

Produtos afetados

Vmware Ace

Vmware Fusion

Vmware Player

Vmware Server

Vmware Workstation

Referências · 13

• http://secunia.com/advisories/39215 · Aviso do Fabricante
• http://lists.vmware.com/pipermail/security-announce/2010/000090.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1138 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2010-0007.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1138 · Nota
• http://securityfocus.com/bid/39395 · Nota
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Aviso do Fabricante
• http://secunia.com/advisories/39203 · Aviso do Fabricante
• http://osvdb.org/63607 · Nota
• http://secunia.com/advisories/39206 · Aviso do Fabricante
• http://securitytracker.com/id?1023836 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html · Nota