PT-2009-3497 · Vmware · Vmware Server+3

Aaron Portnoy · Published 2009-04-06 · Updated 2017-09-29 · CVE-2009-0909

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 6.5.x before 6.5.2 build 156735 VMware Player versions 2.5.x before 2.5.2 build 156735 VMware ACE versions 2.5.x before 2.5.2 build 156735 VMware Server versions 2.0.x before 2.0.1 build 156745

Description A heap-based buffer overflow in the VNnc Codec allows remote attackers to execute arbitrary code via a crafted web page or video file.

Recommendations For VMware Workstation versions 6.5.x before 6.5.2 build 156735, update to version 6.5.2 build 156735 or later. For VMware Player versions 2.5.x before 2.5.2 build 156735, update to version 2.5.2 build 156735 or later. For VMware ACE versions 2.5.x before 2.5.2 build 156735, update to version 2.5.2 build 156735 or later. For VMware Server versions 2.0.x before 2.0.1 build 156745, update to version 2.0.1 build 156745 or later.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-0909

Affected Products

Vmware Ace

Vmware Player

Vmware Server

Vmware Workstation

References · 10

• 🔥 http://securityfocus.com/bid/34373 · Exploit
• http://seclists.org/fulldisclosure/2009/Apr/0036.html · Patch
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0909 · Security Note
• http://lists.vmware.com/pipermail/security-announce/2009/000054.html · Vendor Advisory
• http://securitytracker.com/id?1021974 · Note
• http://vupen.com/english/advisories/2009/0944 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6251 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0909 · Note
• http://vmware.com/security/advisories/VMSA-2009-0005.html · Note