CVE-2008-1363
VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x before 2.0.1 and 1.0.x before 1.0.5, and VMware Server 1.0.x before 1.0.5 on Windows allow local users to gain privileges via an unspecified manipulation of a config.ini file located in an Application Data folder, which can be used for "hijacking the VMX process."
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.42% probability · 36th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- vmware/ace · vmware/player · vmware/server · vmware/workstation
- Source
- cve@mitre.org
References
- http://lists.vmware.com/pipermail/security-announce/2008/000008.htmlVendor Advisory
- http://security.gentoo.org/glsa/glsa-201209-25.xmlThird Party Advisory
- http://securityreason.com/securityalert/3755Third Party Advisory
- http://securitytracker.com/id?1019622Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/489739/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/28276Patch, Third Party Advisory, VDB Entry
- http://www.vmware.com/security/advisories/VMSA-2008-0005.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/player/doc/releasenotes_player.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/player2/doc/releasenotes_player2.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/server/doc/releasenotes_server.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlPatch, Vendor Advisory
- http://www.vupen.com/english/advisories/2008/0905/referencesThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41252Third Party Advisory, VDB Entry
- http://lists.vmware.com/pipermail/security-announce/2008/000008.htmlVendor Advisory
- http://security.gentoo.org/glsa/glsa-201209-25.xmlThird Party Advisory
- http://securityreason.com/securityalert/3755Third Party Advisory
- http://securitytracker.com/id?1019622Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/489739/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/28276Patch, Third Party Advisory, VDB Entry
- http://www.vmware.com/security/advisories/VMSA-2008-0005.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/ace2/doc/releasenotes_ace2.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/player/doc/releasenotes_player.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/player2/doc/releasenotes_player2.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/server/doc/releasenotes_server.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/ws55/doc/releasenotes_ws55.htmlPatch, Vendor Advisory
- http://www.vmware.com/support/ws6/doc/releasenotes_ws6.htmlPatch, Vendor Advisory
- http://www.vupen.com/english/advisories/2008/0905/referencesThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41252Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.