PT-2009-5025 · Vmware · Vmware Player+3

Will Dormann · Published 2009-09-08 · Updated 2018-10-10 · CVE-2009-2628

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Movie Decoder versions prior to 6.5.3 build 185404 VMware Workstation versions prior to 6.5.3 build 185404 VMware Player versions prior to 2.5.3 build 185404 VMware ACE versions prior to 2.5.3 build 185404

Description The issue arises from the VMnc media codec in vmnc.dll not properly handling certain small heights in video content. This could allow remote attackers to execute arbitrary code via a crafted AVI file, triggering heap memory corruption.

Recommendations For VMware Movie Decoder versions prior to 6.5.3 build 185404, update to version 6.5.3 build 185404 or later. For VMware Workstation versions prior to 6.5.3 build 185404, update to version 6.5.3 build 185404 or later. For VMware Player versions prior to 2.5.3 build 185404, update to version 2.5.3 build 185404 or later. For VMware ACE versions prior to 2.5.3 build 185404, update to version 2.5.3 build 185404 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-2628

Affected Products

Vmware Ace

Vmware Movie Decoder

Vmware Player

Vmware Workstation

References · 9

• http://vmware.com/security/advisories/VMSA-2009-0012.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/2553 · Vendor Advisory
• http://lists.vmware.com/pipermail/security-announce/2009/000065.html · Patch
• http://secunia.com/advisories/34938 · Vendor Advisory
• http://securityfocus.com/bid/36290 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2628 · Security Note
• http://kb.cert.org/vuls/id/444513 · Note
• http://securityfocus.com/archive/1/506286/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2628 · Note