ID CVE-2008-2100
Summary Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x, VMware Player 1.x and 2.x, VMware ACE 2.x, VMware Server 1.x, VMware Fusion 1.x, VMware ESXi 3.5, and VMware ESX 3.0.1 through 3.5 allow guest OS users to execute arbitrary code on the host OS via unspecified vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:vmware:ace:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:1.0.3_build_54075:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:1.0.3_build_54075:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:2.0.1_build_55017:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:2.0.1_build_55017:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:ace:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:ace:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:esx_server:3.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:esx_server:3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:esx_server:3.5:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:esx_server:3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:esxi:3.5:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:esxi:3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:fusion:-:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:fusion:-:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.5_build_56455:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.5_build_56455:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:1.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:1.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:2.0.1_build_55017:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:2.0.1_build_55017:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:player:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:player:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:-:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:-:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0.1_build_29996:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0.1_build_29996:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0.4_build_56528:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0.4_build_56528:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:server:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:server:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.0_build_13124:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.0_build_13124:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.1_build_19175:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.1_build_19175:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.3_build_34685:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.3_build_34685:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.3_build_42958:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.3_build_42958:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.4_build_44386:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.4_build_44386:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.5_build_56455:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.5_build_56455:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:5.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:5.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:6.0:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:6.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:6.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:6.0.1_build_55017:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:6.0.1_build_55017:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:6.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:6.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vmware:workstation:6.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:vmware:workstation:6.0.3:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:2.5.4:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:2.5.4:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:2.5.5:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:2.5.5:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.0.0:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.0.0:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.0.1:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.0.2:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.0.2:*:*:*:*:*:*:*
  • cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:*
    cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:*
CVSS
Base: 7.2 (as of 14-08-2019 - 11:29)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:C/I:C/A:C
oval via4
  • accepted 2010-05-17T04:00:02.285-04:00
    class vulnerability
    contributors
    • name Michael Wood
      organization Hewlett-Packard
    • name J. Daniel Brown
      organization DTCC
    definition_extensions
    • comment VMWare ESX Server 3.0.2 is installed
      oval oval:org.mitre.oval:def:5613
    • comment VMWare ESX Server 3.0.1 is installed
      oval oval:org.mitre.oval:def:5367
    description Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x, VMware Player 1.x and 2.x, VMware ACE 2.x, VMware Server 1.x, VMware Fusion 1.x, VMware ESXi 3.5, and VMware ESX 3.0.1 through 3.5 allow guest OS users to execute arbitrary code on the host OS via unspecified vectors.
    family unix
    id oval:org.mitre.oval:def:5081
    status accepted
    submitted 2008-06-10T15:10:44.000-05:00
    title VMware Buffer Overflows in VIX API Let Local Users Execute Arbitrary Code
    version 5
  • accepted 2010-05-17T04:00:05.259-04:00
    class vulnerability
    contributors
    • name Michael Wood
      organization Hewlett-Packard
    • name J. Daniel Brown
      organization DTCC
    definition_extensions
    • comment VMWare ESX Server 3.0.2 is installed
      oval oval:org.mitre.oval:def:5613
    • comment VMWare ESX Server 3.0.1 is installed
      oval oval:org.mitre.oval:def:5367
    description Multiple buffer overflows in VIX API 1.1.x before 1.1.4 build 93057 on VMware Workstation 5.x and 6.x, VMware Player 1.x and 2.x, VMware ACE 2.x, VMware Server 1.x, VMware Fusion 1.x, VMware ESXi 3.5, and VMware ESX 3.0.1 through 3.5 allow guest OS users to execute arbitrary code on the host OS via unspecified vectors.
    family unix
    id oval:org.mitre.oval:def:5647
    status accepted
    submitted 2008-06-10T15:10:44.000-05:00
    title VMware Buffer Overflows in VIX API Let Local Users Execute Arbitrary Code
    version 7
refmap via4
bid 29552
bugtraq 20080604 VMSA-2008-0009 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues
confirm http://www.vmware.com/security/advisories/VMSA-2008-0009.html
gentoo GLSA-201209-25
sectrack 1020200
secunia 30556
sreason 3922
vupen ADV-2008-1744
xf vmware-vixapi-multiple-unspecified-bo(42872)
Last major update 14-08-2019 - 11:29
Published 05-06-2008 - 20:32
Back to Top