PT-2014-4670 · Vmware · Vmware Player+1

Published 2014-04-15 · Updated 2014-04-16 · CVE-2014-2384

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation version 10.0.1 build 1379776 VMware Player version 6.0.1 build 1379776

Description The issue allows local users to cause a denial of service, resulting in a read access violation and system crash, via a crafted buffer in an IOCTL call. The vendor has rated this issue as non-exploitable.

Recommendations For VMware Workstation version 10.0.1 build 1379776, consider restricting access to the vmx86.sys driver to minimize the risk of exploitation. For VMware Player version 6.0.1 build 1379776, consider restricting access to the vmx86.sys driver to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-2384

Affected Products

Vmware Player

Vmware Workstation

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2384 · Security Note
• http://seclists.org/fulldisclosure/2014/Apr/163 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2384 · Note
• https://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2384 · Note