Description
Two vulnerabilities have been identified in various VMware products, which could be exploited by attackers or malicious users to disclose sensitive information or gain elevated privileges. The first issue is caused due to an improper setting of the exception code on page faults on guest operating systems, which could allow malicious users to gain elevated privileges on a guest OS. The second vulnerability is caused by an unspecified input validation error, which could allow attackers with access to the network on which the host resides to download any file from the host system via directory traversal attacks
The following programs are vulnerable.
- VMware Workstation version 6.5.2 and prior
- VMware Player version 2.5.2 and prior
- VMware ACE version 2.5.2 and prior
- VMware Server version 2.0.1 and prior
- VMware Server version 1.0.9 and prior
- VMware Fusion version 2.0.5 and prior
- VMware ESXi version 4.0
- VMware ESXi version 3.5
- VMware ESX version 4.0
- VMware ESX version 3.5
- VMware ESX version 3.0.3
- VMware ESX version 2.5.5
Remediation
Apply patches or upgrade to fixed versions.
References
Related Vulnerabilities
WordPress Plugin YouTube Gallery-Best YouTube Video Gallery Cross-Site Scripting (3.2.1)
PHP Other Vulnerability (CVE-2007-0448)
WordPress Plugin Event Notifier Cross-Site Scripting (1.2.0)
phpMyFAQ Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3783)
phpMyAdmin Improper Authentication Vulnerability (CVE-2018-12613)