Unscored severity · published Apr 12, 2010
CVE-2010-1138
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1…
–
CVSS
2.3%
EPSS
No
On KEV
Description
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware Server 2.x, and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Ace · Vmware
2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.6 · source: NVD
FU
Fusion · Vmware
2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +2 more · source: NVD
PL
Player · Vmware
3.0; 2.5; 2.5.1; 2.5.2; 2.5.3 · source: NVD
SE
Server · Vmware
2.0.0; 2.0.1; 2.0.2 · source: NVD
WO
Workstation · Vmware
7.0; 6.5.0; 6.5.1; 6.5.2; 6.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-1138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-1138
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html
Patch
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
osvdb.org
http://osvdb.org/63607
Vendor Advisory
http://secunia.com/advisories/39203
Vendor Advisory
http://secunia.com/advisories/39206
More from Ace
–
CVE-2009-4811
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459,…
–
CVE-2010-1142
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x…
–
CVE-2010-1141
VMware Tools in VMware Workstation 6.5.x before 6.5.4 build 246459; VMware Player 2.5.x before 2.5.4 build 246459; VMware ACE 2.5.x before 2.5.4 build 246459; VMware Server 2.x…
–
CVE-2009-3732
Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors
–
CVE-2009-2267
VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, VMware ACE 2.5.x before 2.5.3 build 185404, VMware Server 1.x before 1.0.10…