PT-2010-2858 · Vmware · Vmware Workstation+6

Mitja Kolsek · Publicado 2010-04-12 · Atualizado 2013-05-15 · CVE-2010-1142

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Tools in VMware Workstation versions 6.5.x through 6.5.3 VMware Player versions 2.5.x through 2.5.3 VMware ACE versions 2.5.x through 2.5.3 VMware Server versions 2.x through 2.0.1 VMware Fusion versions 2.x through 2.0.5 VMware ESXi versions 3.5 and 4.0 VMware ESX versions 2.5.5, 3.0.3, 3.5, and 4.0

Description The issue might allow Windows guest OS users to gain privileges by placing a Trojan horse program at an unspecified location on the guest OS disk, due to improper loading of VMware programs.

Recommendations For VMware Workstation versions 6.5.x through 6.5.3, update to version 6.5.4 build 246459 or later. For VMware Player versions 2.5.x through 2.5.3, update to version 2.5.4 build 246459 or later. For VMware ACE versions 2.5.x through 2.5.3, update to version 2.5.4 build 246459 or later. For VMware Server versions 2.x through 2.0.1, update to version 2.0.2 build 203138 or later. For VMware Fusion versions 2.x through 2.0.5, update to version 2.0.6 build 246742 or later. For VMware ESXi versions 3.5 and 4.0, and VMware ESX versions 2.5.5, 3.0.3, 3.5, and 4.0, update to a version that properly loads VMware programs.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-1142

Produtos afetados

Vmware Ace

Vmware Esxi

Vmware Fusion

Vmware Player

Vmware Server

Vmware Tools

Vmware Workstation

Referências · 13

• http://securitytracker.com/id?1023833 · Nota
• http://lists.vmware.com/pipermail/security-announce/2010/000090.html · Aviso do Fabricante
• http://securitytracker.com/id?1023832 · Nota
• http://vmware.com/security/advisories/VMSA-2010-0007.html · Aviso do Fabricante
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html · Nota
• http://securityfocus.com/bid/39394 · Nota
• http://secunia.com/advisories/39198 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Aviso do Fabricante
• http://secunia.com/advisories/39206 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1142 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-1142 · Nota de Segurança
• http://acrossecurity.com/aspr/ASPR-2010-04-12-2-PUB.txt · Nota