CVE-2007-5618

Unquoted Windows search path vulnerability in the Authorization and other services in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, VMware Server before 1.0.4, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1 might allow local users to gain privileges via malicious programs.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.vmware.com/support/player/doc/releasenotes_player.html	Patch Vendor Advisory
http://www.vmware.com/support/player2/doc/releasenotes_player2.html	Patch Vendor Advisory
http://www.vmware.com/support/server/doc/releasenotes_server.html	Patch Vendor Advisory
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html	Patch Vendor Advisory
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html	Patch Vendor Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html	Third Party Advisory
http://secunia.com/advisories/26890	Third Party Advisory
http://lists.vmware.com/pipermail/security-announce/2008/000008.html	Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2008-0005.html	Vendor Advisory
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html	Vendor Advisory
http://www.securityfocus.com/bid/28276	Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2007/3229	Third Party Advisory
http://www.vupen.com/english/advisories/2008/0905/references	Third Party Advisory
http://www.securityfocus.com/bid/28289	Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/489739/100/0/threaded	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:workstation::::::::
	cpe:2.3:a:vmware:workstation::::::::
	cpe:2.3:a:vmware:player::::::::
	cpe:2.3:a:vmware:server::::::::
	cpe:2.3:a:vmware:player::::::::

Information

Published : 2007-10-21 14:17

Updated : 2018-10-26 07:17

NVD link : CVE-2007-5618

Mitre link : CVE-2007-5618

JSON object : View

CWE

NVD-CWE-noinfo

Advertisement

Products Affected

vmware

workstation
player
server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.vmware.com/support/player/doc/releasenotes_player.html", "name": "http://www.vmware.com/support/player/doc/releasenotes_player.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/player2/doc/releasenotes_player2.html", "name": "http://www.vmware.com/support/player2/doc/releasenotes_player2.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/server/doc/releasenotes_server.html", "name": "http://www.vmware.com/support/server/doc/releasenotes_server.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html", "name": "http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html", "name": "http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html", "name": "20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player", "tags": ["Third Party Advisory"], "refsource": "FULLDISC"}, {"url": "http://secunia.com/advisories/26890", "name": "26890", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://lists.vmware.com/pipermail/security-announce/2008/000008.html", "name": "[security-announce] 20080317 VMSA-2008-0005 Updated VMware Workstation, VMware Player, VMware Server, VMware ACE, and VMware Fusion resolve critical security issues", "tags": ["Vendor Advisory"], "refsource": "MLIST"}, {"url": "http://www.vmware.com/security/advisories/VMSA-2008-0005.html", "name": "http://www.vmware.com/security/advisories/VMSA-2008-0005.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html", "name": "http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/28276", "name": "28276", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.vupen.com/english/advisories/2007/3229", "name": "ADV-2007-3229", "tags": ["Third Party Advisory"], "refsource": "VUPEN"}, {"url": "http://www.vupen.com/english/advisories/2008/0905/references", "name": "ADV-2008-0905", "tags": ["Third Party Advisory"], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/bid/28289", "name": "28289", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securityfocus.com/archive/1/489739/100/0/threaded", "name": "20080318 VMSA-2008-0005 Updated VMware Workstation, VMware Player, VMware Server, VMware ACE, and VMware Fusion resolve critical security issues", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Unquoted Windows search path vulnerability in the Authorization and other services in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, VMware Server before 1.0.4, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1 might allow local users to gain privileges via malicious programs."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-5618", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-10-21T21:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.5.5", "versionStartIncluding": "5.5"}, {"cpe23Uri": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.0.1", "versionStartIncluding": "6.0"}, {"cpe23Uri": "cpe:2.3:a:vmware:player:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.0.5", "versionStartIncluding": "1.0.0"}, {"cpe23Uri": "cpe:2.3:a:vmware:server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "1.0.4"}, {"cpe23Uri": "cpe:2.3:a:vmware:player:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.0.1", "versionStartIncluding": "2.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-26T14:17Z"}