PT-2010-1260 · Vmware · Vmware Server+4

Published 2010-04-12 · Updated 2010-04-22 · CVE-2009-1564

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Movie Decoder versions prior to 6.5.4 Build 246459 VMware Workstation versions prior to 6.5.4 build 246459 VMware Player versions prior to 2.5.4 build 246459 VMware Server versions prior to 2.x on Windows

Description The issue is related to a heap-based buffer overflow in the vmnc.dll component of the VMnc media codec. This can be exploited by remote attackers through an AVI file containing crafted video chunks that utilize HexTile encoding, potentially allowing the execution of arbitrary code.

Recommendations For VMware Movie Decoder versions prior to 6.5.4 Build 246459, update to version 6.5.4 Build 246459 or later. For VMware Workstation versions prior to 6.5.4 build 246459, update to version 6.5.4 build 246459 or later. For VMware Player versions prior to 2.5.4 build 246459, update to version 2.5.4 build 246459 or later. For VMware Server versions prior to 2.x on Windows, update to a version that is not affected by this issue.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1564

Affected Products

Vmware Movie Decoder

Vmware Player

Vmware Server

Vmware Workstation

Vmnc.Dll

References · 14

• http://secunia.com/advisories/39215 · Vendor Advisory
• http://secunia.com/secunia_research/2009-36 · Vendor Advisory
• http://secunia.com/advisories/36712 · Vendor Advisory
• http://vmware.com/security/advisories/VMSA-2010-0007.html · Vendor Advisory
• http://secunia.com/advisories/39206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1564 · Security Note
• http://securityfocus.com/bid/39363 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1564 · Note
• http://osvdb.org/63614 · Note
• http://securitytracker.com/id?1023838 · Note
• http://lists.vmware.com/pipermail/security-announce/2010/000090.html · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=866 · Note
• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html · Note