PT-2010-2857 · Vmware+1 · Vmware Workstation+6

Publicado 2010-04-12 · Atualizado 2017-09-19 · CVE-2010-1141

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 6.5.x through 6.5.3 VMware Player versions 2.5.x through 2.5.3 VMware ACE versions 2.5.x through 2.5.3 VMware Server versions 2.x through 2.0.1 VMware Fusion versions 2.x through 2.0.5 VMware ESXi versions 3.5 and 4.0 VMware ESX versions 2.5.5, 3.0.3, 3.5, and 4.0

Description The issue allows user-assisted remote attackers to execute arbitrary code by tricking a Windows guest OS user into clicking on a file stored on a network share, due to improper library access.

Recommendations For VMware Workstation versions 6.5.x through 6.5.3, update to version 6.5.4 build 246459 or later. For VMware Player versions 2.5.x through 2.5.3, update to version 2.5.4 build 246459 or later. For VMware ACE versions 2.5.x through 2.5.3, update to version 2.5.4 build 246459 or later. For VMware Server versions 2.x through 2.0.1, update to version 2.0.2 build 203138 or later. For VMware Fusion versions 2.x through 2.0.5, update to version 2.0.6 build 246742 or later. For VMware ESXi versions 3.5 and 4.0, and VMware ESX versions 2.5.5, 3.0.3, 3.5, and 4.0, update to a version that properly accesses libraries.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-1141

Produtos afetados

Vmware Ace

Vmware Esxi

Vmware Fusion

Vmware Player

Vmware Server

Vmware Workstation

Windows

Referências · 12

• http://securitytracker.com/id?1023833 · Nota
• http://lists.vmware.com/pipermail/security-announce/2010/000090.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-1141 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7020 · Nota
• http://securitytracker.com/id?1023832 · Nota
• http://vmware.com/security/advisories/VMSA-2010-0007.html · Aviso do Fabricante
• http://secunia.com/advisories/39198 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Aviso do Fabricante
• http://secunia.com/advisories/39206 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html · Nota