PT-2013-3131 · Vmware · Vmware Esxi+3

Published 2013-02-11 · Updated 2017-09-19 · CVE-2013-1406

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 8.0 through 8.0.4 VMware Workstation version 9.0 VMware Fusion versions 4.1 through 4.1.3 VMware Fusion version 5.0 VMware View versions 4.x through 4.6.1 VMware View versions 5.x through 5.1.1 VMware ESXi versions 4.0 through 5.1 VMware ESX versions 4.0 through 4.1

Description The Virtual Machine Communication Interface (VMCI) implementation does not properly restrict memory allocation by control code, allowing local users to gain privileges via unspecified vectors.

Recommendations For VMware Workstation versions 8.0 through 8.0.4, update to version 8.0.5 or later. For VMware Workstation version 9.0, update to version 9.0.1 or later. For VMware Fusion versions 4.1 through 4.1.3, update to version 4.1.4 or later. For VMware Fusion version 5.0, update to version 5.0.2 or later. For VMware View versions 4.x through 4.6.1, update to version 4.6.2 or later. For VMware View versions 5.x through 5.1.1, update to version 5.1.2 or later. For VMware ESXi versions 4.0 through 5.1, update to a version later than 5.1. For VMware ESX versions 4.0 through 4.1, update to a version later than 4.1.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1406

Affected Products

Vmware Esxi

Vmware Fusion

Vmware View

Vmware Workstation

References · 5

• 🔥 https://exploit-db.com/exploits/40164 · Exploit
• http://vmware.com/security/advisories/VMSA-2013-0002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1406 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1406 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17164 · Note