Description:
Multiple vulnerabilities have been reported in various VMware products, which can be exploited by malicious, local users to gain escalated privileges or cause a DoS (Denial of Service) or by malicious people to compromise a vulnerable system.
1) An unspecified error can be exploited by a user with administrative privileges in the guest system to cause a memory corruption on a certain host process.
Successful exploitation may allow execution of arbitrary code on the host system.
2) An unspecified error can be exploited within the guest system to cause a host process to crash.
The vulnerabilities affect VMWare ESX 3.0.1, 3.0.0, 2.5.4, 2.5.3, 2.1.3, and 2.0.2, VMWare Workstation 6.0.0 and 5.5.4, VMWare Player 2.0.0 and 1.0.4, VMWare Server 1.0.3, and VMWare ACE 2.0.0 and 1.0.3.
3) An integer underflow error in the DHCP server can be exploited to cause a stack-based buffer overflow via a specially crafted DHCP packet.
4) An integer overflow error in the DHCP server can be exploited to cause a stack-based buffer overflow via a specially crafted DHCP packet.
5) Improper handling of malformed DHCP packets can be exploited to execute arbitrary code via a specially crafted DHCP packet.
Successful exploitation of the vulnerabilities allow execution of arbitrary code.
6) Improper starting of registered services can be exploited to gain escalated privileges.
The vulnerabilities affect VMWare Workstation 6.0.0 and 5.5.4, VMWare Player 2.0.0 and 1.0.4, VMWare Server 1.0.3, and VMWare ACE 2.0.0 and 1.0.3.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, scan using the Network Software Inspector.
|
