PT-2010-1620 · Vmware · Vmware Server+3

Published 2010-04-27 · Updated 2024-02-14 · CVE-2009-4811

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 7.0 through 7.0.0 build 227600 VMware Workstation version 6.5.x through 6.5.3 build 246459 VMware Player versions 3.0 through 3.0.0 build 227600 VMware Player version 2.5.x through 2.5.3 build 246459 VMware ACE versions 2.6 through 2.6.0 build 227600 VMware ACE version 2.5.x through 2.5.3 build 246459 VMware Server version 2.x

Description The issue allows remote attackers to cause a denial of service (process crash) via a x25x90 sequence in the USER and PASS commands.

Recommendations For VMware Workstation versions 7.0 through 7.0.0 build 227600, update to version 7.0.1 build 227600 or later. For VMware Workstation version 6.5.x through 6.5.3 build 246459, update to version 6.5.4 build 246459 or later. For VMware Player versions 3.0 through 3.0.0 build 227600, update to version 3.0.1 build 227600 or later. For VMware Player version 2.5.x through 2.5.3 build 246459, update to version 2.5.4 build 246459 or later. For VMware ACE versions 2.6 through 2.6.0 build 227600, update to version 2.6.1 build 227600 or later. For VMware ACE version 2.5.x through 2.5.3 build 246459, update to version 2.5.4 build 246459 or later. For VMware Server version 2.x, update to a version that is not affected by this issue.

Exploit

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2009-4811

Affected Products

Vmware Ace

Vmware Player

Vmware Server

Vmware Workstation

References · 10

• 🔥 http://freetexthost.com/qr1tffkzpu · Exploit
• 🔥 http://pocoftheday.blogspot.com/2009/10/vmware-server-20x-remote-dos-exploit.html · Exploit
• 🔥 http://securityfocus.com/bid/36630 · Exploit
• http://lists.vmware.com/pipermail/security-announce/2010/000090.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4811 · Security Note
• http://vmware.com/security/advisories/VMSA-2010-0007.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4811 · Note
• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html · Note