PT-2008-1515 · Vmware · Vmware Server+6

Stephen Fewer · Published 2008-06-05 · Updated 2018-10-30 · CVE-2007-5671

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 5.x through 5.5.6 build 80404 VMware Player versions prior to 1.0.6 build 80404 VMware ACE versions prior to 1.0.5 build 79846 VMware Server versions prior to 1.0.5 build 80187 VMware ESX versions 2.5.4 through 3.0.2

Description The issue arises from improper validation of arguments in user-mode METHOD NEITHER IOCTLs to the .hgfs device by HGFS.sys in the VMware Tools package. This allows guest OS users to modify arbitrary memory locations in guest kernel memory, potentially leading to privilege escalation.

Recommendations For VMware Workstation versions 5.x through 5.5.6 build 80404, update to version 5.5.6 build 80404 or later. For VMware Player versions prior to 1.0.6 build 80404, update to version 1.0.6 build 80404 or later. For VMware ACE versions prior to 1.0.5 build 79846, update to version 1.0.5 build 79846 or later. For VMware Server versions prior to 1.0.5 build 80187, update to version 1.0.5 build 80187 or later. For VMware ESX versions 2.5.4 through 3.0.2, update to a version later than 3.0.2.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-5671

Affected Products

Hgfs.Sys

Vmware Ace

Vmware Esxi

Vmware Player

Vmware Server

Vmware Tools

Vmware Workstation

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2007-5671 · Security Note
• http://secunia.com/advisories/30556 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Vendor Advisory
• http://securityfocus.com/archive/1/493080/100/0/threaded · Note
• http://securityfocus.com/archive/1/493172/100/0/threaded · Note
• http://vmware.com/security/advisories/VMSA-2008-0009.html · Note
• http://securitytracker.com/id?1020197 · Note
• http://securityreason.com/securityalert/3922 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5688 · Note
• http://vupen.com/english/advisories/2008/1744 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=712 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5358 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5671 · Note
• http://securityfocus.com/archive/1/493148/100/0/threaded · Note