PT-2014-1177 · Vmware+1 · Vmware Player+4

Published 2014-05-31 · Updated 2018-10-09 · CVE-2014-3793

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 5.0 through 5.5 VMware Workstation versions 10.x before 10.0.2 VMware Player versions 6.x before 6.0.2 VMware Fusion versions 6.x before 6.0.3

Description The issue allows an attacker, working in a guest OS Windows 8.1, to potentially gain guest OS privileges or cause a denial of service by forming unspecified vectors, which can lead to a kernel NULL pointer dereference and guest OS crash.

Recommendations For VMware ESXi versions 5.0 through 5.5, update to a version later than 5.5 to resolve the issue. For VMware Workstation versions 10.x before 10.0.2, update to version 10.0.2 or later. For VMware Player versions 6.x before 6.0.2, update to version 6.0.2 or later. For VMware Fusion versions 6.x before 6.0.3, update to version 6.0.3 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2014-00322

CVE-2014-3793

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Player

Vmware Workstation

Windows 8.1

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2014-3793 · Security Note
• https://bdu.fstec.ru/vul/2014-00322 · Security Note
• http://securitytracker.com/id/1030310 · Note
• http://securitytracker.com/id/1030311 · Note
• http://vmware.com/security/advisories/vmsa-2014-0005.html · Note
• http://packetstormsecurity.com/files/126869/VMware-Security-Advisory-2014-0005.html · Note
• http://vmware.com/security/advisories/VMSA-2014-0005.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3793 · Note
• http://securityfocus.com/archive/1/532236/100/0/threaded · Note
• http://kb.vmware.com/kb/2065832 · Note
• http://secunia.com/advisories/58894 · Note