10

CVE-2008-3892

Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call.  NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Ace Version >= 1.0 < 1.0.7
VMware ≫ Ace Version >= 2.0 < 2.0.5
VMware ≫ Player Version >= 1.0.0 < 1.0.8
VMware ≫ Player Version >= 2.0 < 2.0.5
VMware ≫ Server Version < 1.0.7
VMware ≫ Workstation Version >= 5.5 < 5.5.8
VMware ≫ Workstation Version >= 6.0 < 6.0.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 24.36% 0.976
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
Vendor Advisory
http://www.vmware.com/support/player/doc/releasenotes_player.html
Vendor Advisory
http://www.vmware.com/support/player2/doc/releasenotes_player2.html
Vendor Advisory
http://www.vmware.com/support/server/doc/releasenotes_server.html
Vendor Advisory
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
Vendor Advisory
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
Vendor Advisory
http://www.vmware.com/support/ace/doc/releasenotes_ace.html
Vendor Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html
Third Party Advisory
http://www.securityfocus.com/archive/1/495869/100/0/threaded
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2008/2466
Third Party Advisory
http://secunia.com/advisories/31707
Patch
Third Party Advisory
http://secunia.com/advisories/31708
Patch
Third Party Advisory
http://secunia.com/advisories/31709
Patch
Third Party Advisory
http://secunia.com/advisories/31710
Patch
Third Party Advisory
http://securityreason.com/securityalert/4202
Third Party Advisory
http://www.securityfocus.com/bid/30934
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/29503
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/43062
VDB Entry
https://www.exploit-db.com/exploits/6345
Third Party Advisory
VDB Entry