PT-2010-2857 · Vmware+1 · Vmware Workstation+6

Published 2010-04-12 · Updated 2017-09-19 · CVE-2010-1141

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 6.5.x through 6.5.3 VMware Player versions 2.5.x through 2.5.3 VMware ACE versions 2.5.x through 2.5.3 VMware Server versions 2.x through 2.0.1 VMware Fusion versions 2.x through 2.0.5 VMware ESXi versions 3.5 and 4.0 VMware ESX versions 2.5.5, 3.0.3, 3.5, and 4.0

Description The issue allows user-assisted remote attackers to execute arbitrary code by tricking a Windows guest OS user into clicking on a file stored on a network share, due to improper library access.

Recommendations For VMware Workstation versions 6.5.x through 6.5.3, update to version 6.5.4 build 246459 or later. For VMware Player versions 2.5.x through 2.5.3, update to version 2.5.4 build 246459 or later. For VMware ACE versions 2.5.x through 2.5.3, update to version 2.5.4 build 246459 or later. For VMware Server versions 2.x through 2.0.1, update to version 2.0.2 build 203138 or later. For VMware Fusion versions 2.x through 2.0.5, update to version 2.0.6 build 246742 or later. For VMware ESXi versions 3.5 and 4.0, and VMware ESX versions 2.5.5, 3.0.3, 3.5, and 4.0, update to a version that properly accesses libraries.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-1141

Affected Products

Vmware Ace

Vmware Esxi

Vmware Fusion

Vmware Player

Vmware Server

Vmware Workstation

Windows

References · 12

• http://lists.vmware.com/pipermail/security-announce/2010/000090.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1141 · Security Note
• http://vmware.com/security/advisories/VMSA-2010-0007.html · Vendor Advisory
• http://secunia.com/advisories/39198 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201209-25.xml · Vendor Advisory
• http://secunia.com/advisories/39206 · Vendor Advisory
• http://securitytracker.com/id?1023833 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7020 · Note
• http://securitytracker.com/id?1023832 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1141 · Note
• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html · Note