PT-2008-2973 · Vmware · Vmware Player+2

Published 2008-03-20 · Updated 2018-10-11 · CVE-2008-1392

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation version 6.0.2 VMware Player versions 2.0.x through 2.0.2 VMware ACE versions 2.0.x through 2.0.0

Description The default configuration of the affected software makes the console of the guest OS accessible through anonymous VIX API calls. The impact and attack vectors of this issue are unknown.

Recommendations For VMware Workstation version 6.0.2, update to a version that addresses this issue. For VMware Player versions 2.0.x through 2.0.2, update to version 2.0.3 or later. For VMware ACE versions 2.0.x through 2.0.0, update to version 2.0.1 or later.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2008-1392

Affected Products

Vmware Ace

Vmware Player

Vmware Workstation

References · 12

• http://vmware.com/security/advisories/VMSA-2008-0005.html · Vendor Advisory
• http://vmware.com/support/player2/doc/releasenotes_player2.html · Vendor Advisory
• http://vmware.com/support/ace2/doc/releasenotes_ace2.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1392 · Security Note
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1392 · Note
• http://lists.vmware.com/pipermail/security-announce/2008/000008.html · Note
• http://vmware.com/support/ws6/doc/releasenotes_ws6.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41551 · Note
• http://securityfocus.com/archive/1/489739/100/0/threaded · Note
• http://securityfocus.com/bid/28276 · Note
• http://securityreason.com/securityalert/3755 · Note