Unscored severity · published Sep 3, 2008
CVE-2008-3698
Unspecified vulnerability in the OpenProcess function in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Unspecified vulnerability in the OpenProcess function in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 on Windows allows local host OS users to gain privileges on the host OS via unknown vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Ace · Vmware
1.0 before 1.0.7; 2.0 before 2.0.5 · source: NVD
PL
Player · Vmware
1.0.0 before 1.0.8; 2.0 before 2.0.5 · source: NVD
SE
Server · Vmware
before 1.0.7 · source: NVD
WO
Workstation · Vmware
5.5 before 5.5.8; 6.0 before 6.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3698
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3698
Third Party Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html
Patch
http://secunia.com/advisories/31707
Third Party Advisory
http://securityreason.com/securityalert/4202
Third Party Advisory
http://securitytracker.com/id?1020790
Third Party Advisory
http://www.securityfocus.com/archive/1/495869/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/30936
More from Ace
–
CVE-2009-4811
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459,…
–
CVE-2010-1142
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x…
–
CVE-2010-1141
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x…
–
CVE-2010-1138
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1…
–
CVE-2009-3732
Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors