Unquoted Windows search path vulnerability in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075, and Server before 1.0.4 Build 56528 allows local users to gain privileges via unspecified vectors, possibly involving a malicious "program.exe" file in the C: folder.

Neel Mehta and Ryan Smith discovered that the VMware Player DHCP server did not correctly handle certain packet structures. Remote attackers could send specially crafted packets and gain root privileges. (CVE-2007-0061, CVE-2007-0062, CVE-2007-0063)

Rafal Wojtczvk discovered multiple memory corruption issues in VMware Player. Attackers with administrative privileges in a guest operating system could cause a denial of service or possibly execute arbitrary code on the host operating system. (CVE-2007-4496, CVE-2007-4497).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of VMware Workstation/Server installed on the remote host is affected by multiple vulnerabilities, including a privelege elevation vulnerability that allows a guest to take over a host and a buffer overflow vulnerability in the DHCP daemon. 

The buffer overlflow in the DHCP server may allow a remote attacker to execute arbitrary code on the remote host with SYSTEM privileges.

ID	Name	Product	Family	Severity
28250	Ubuntu 6.06 LTS / 6.10 / 7.04 : linux-restricted-modules-2.6.17/20, vmware-player-kernel-2.6.15 vulnerabilities (USN-543-1)	Nessus	Ubuntu Local Security Checks	critical
26911	VMware Workstation < 5.5.5 and Server < 1.0.4 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2007-5023

high

Tenable Plugins

critical

critical