News
Vigil@nce: VMware, code execution
June 2008 by Vigil@nce
SYNTHESIS
Two vulnerabilities impact VMware ACE, VMware Player and VMware
Workstation.
Gravity: 2/4
Consequences: administrator access/rights
Provenance: user shell
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 30/05/2008
Identifier: VIGILANCE-VUL-7864
IMPACTED PRODUCTS
– VMware ACE [confidential versions]
– VMware Player [confidential versions]
– VMware Workstation [confidential versions]
DESCRIPTION
Two vulnerabilities impact VMware ACE, VMware Player and VMware
Workstation.
On Windows hosts, if VMCI is enabled, a guest system can execute
code in the context of the vmx process on the host. [grav:2/4;
234208, CVE-2008-2099]
An attacker can create a buffer overflow in HGFS (Host Guest File
System). [grav:2/4; 234214, CVE-2008-2098]
CHARACTERISTICS
Identifiers: 234208, 234214, CVE-2008-2098, CVE-2008-2099,
VIGILANCE-VUL-7864
