Detections
Analytics
GLSA-201209-25 : VMware Player, Server, Workstation: Multiple vulnerabilities
medium Nessus Plugin ID 62383
Language:
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-201209-25 (VMware Player, Server, Workstation: Multiple vulnerabilities)Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details.
Impact :
Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information.
A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.
Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).
Workaround :
There is no known workaround at this time.
Solution
Gentoo discontinued support for VMware Player. We recommend that users unmerge VMware Player:# emerge --unmerge 'app-emulation/vmware-player' NOTE: Users could upgrade to “>=app-emulation/vmware-player-3.1.5”, however these packages are not currently stable.
Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Workstation:
# emerge --unmerge 'app-emulation/vmware-workstation' NOTE: Users could upgrade to “>=app-emulation/vmware-workstation-7.1.5”, however these packages are not currently stable.
Gentoo discontinued support for VMware Server. We recommend that users unmerge VMware Server:
# emerge --unmerge 'app-emulation/vmware-server'
See Also
Plugin Details
Severity: Medium
ID: 62383
File Name: gentoo_GLSA-201209-25.nasl
Version: 1.26
Type: local
Family: Gentoo Local Security Checks
Published: 10/1/2012
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.0
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 6.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:vmware-player, p-cpe:/a:gentoo:linux:vmware-server, p-cpe:/a:gentoo:linux:vmware-workstation, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/29/2012
Vulnerability Publication Date: 10/8/2007
Exploitable With
CANVAS (D2ExploitPack)
Core Impact
Elliot (Vmware Server File Disclosure)
ExploitHub (EH-14-757)
Reference Information
CVE: CVE-2007-5269, CVE-2007-5503, CVE-2007-5671, CVE-2008-0967, CVE-2008-1340, CVE-2008-1361, CVE-2008-1362, CVE-2008-1363, CVE-2008-1364, CVE-2008-1392, CVE-2008-1447, CVE-2008-1806, CVE-2008-1807, CVE-2008-1808, CVE-2008-2098, CVE-2008-2100, CVE-2008-2101, CVE-2008-4915, CVE-2008-4916, CVE-2008-4917, CVE-2009-0040, CVE-2009-0909, CVE-2009-0910, CVE-2009-1244, CVE-2009-2267, CVE-2009-3707, CVE-2009-3732, CVE-2009-3733, CVE-2009-4811, CVE-2010-1137, CVE-2010-1138, CVE-2010-1139, CVE-2010-1140, CVE-2010-1141, CVE-2010-1142, CVE-2010-1143, CVE-2011-3868
BID: 29552, 29557, 29637, 25956, 26650, 28276, 28289, 29444, 29639, 29640, 29641, 30131, 30937, 32168, 32597, 33827, 33990, 34373, 34471, 36630, 36841, 36842, 39104, 39392, 39394, 39395, 39396, 39397, 39407, 39949, 49942