PT-2010-2931 · Microsoft · Virtual Pc 2007+2

Published 2010-04-01 · Updated 2018-10-10 · CVE-2010-1225

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Virtual PC 2007 versions Gold through SP1 Microsoft Virtual Server 2005 versions Gold through R2 SP1 Windows Virtual PC (affected versions not specified)

Description The issue is related to the memory-management implementation in the Virtual Machine Monitor, which does not properly restrict access from the guest OS to memory locations in the VMM work area. This allows attackers to bypass certain anti-exploitation protection mechanisms on the guest OS via crafted input to a vulnerable application. It is noted that only systems with an otherwise vulnerable application are affected.

Recommendations For Microsoft Virtual PC 2007 versions Gold through SP1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Virtual Server 2005 versions Gold through R2 SP1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Windows Virtual PC: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-1225

Affected Products

Virtual Pc 2007

Virtual Server 2005

Windows Virtual Pc

References · 6

• 🔥 https://exploit-db.com/exploits/11786 · Exploit
• 🔥 http://securityfocus.com/bid/38764 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1225 · Security Note
• http://securitytracker.com/id?1023720 · Note
• http://securityfocus.com/archive/1/510154/100/0/threaded · Note
• http://coresecurity.com/content/virtual-pc-2007-hypervisor-memory-protection-bug · Note