CVE-2007-0063 - 漏洞详情

CVE-2007-0063 (CNNVD-200709-310)

CRITICAL

中文标题:

VMware Workstation和VMware Workstation Player 数字错误漏洞

英文标题:

Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x befo...

CVSS分数: 10.0

发布时间: 2007-09-21 18:00:00

漏洞类型: 数字错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

VMware Workstation和VMware Workstation Player都是美国威睿（VMware）公司的产品。VMware Workstation是一套虚拟机软件。该软件提供可以同时运行多个不同的操作系统的虚拟机功能。VMware Workstation Player是一套免费开源的且功能较简单的虚拟机软件。多款VMWare产品中的DHCP服务器存在数字错误漏洞，远程攻击者可利用该漏洞执行任意代码。以下产品及版本受到影响：VMware Workstation 5.5.5 Build 56455之前版本，6.0.1 Build 55017之前的6.x版本；Player 1.0.5 Build 56455之前版本，2.0.1 Build 55017之前的2版本；ACE 1.0.3 Build 54075之前版本，2.0.1 Build 55017之前的2版本；Server 1.0.4 Build 56528之前版本。

英文描述:

Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.

CWE类型:

CWE-191

受影响产品

厂商	产品	版本	版本范围	平台	CPE
vmware	ace	*	-	-	`cpe:2.3:a:vmware:ace::::::::`
vmware	player	*	-	-	`cpe:2.3:a:vmware:player::::::::`
vmware	server	*	-	-	`cpe:2.3:a:vmware:server::::::::`
vmware	workstation	*	-	-	`cpe:2.3:a:vmware:workstation::::::::`
vmware	esx	2.0.2	-	-	`cpe:2.3:o:vmware:esx:2.0.2:::::::*`
vmware	esx	2.1.3	-	-	`cpe:2.3:o:vmware:esx:2.1.3:::::::*`
vmware	esx	2.5.3	-	-	`cpe:2.3:o:vmware:esx:2.5.3:::::::*`
vmware	esx	2.5.4	-	-	`cpe:2.3:o:vmware:esx:2.5.4:::::::*`
vmware	esx	3.0.0	-	-	`cpe:2.3:o:vmware:esx:3.0.0:::::::*`
vmware	esx	3.0.1	-	-	`cpe:2.3:o:vmware:esx:3.0.1:::::::*`
canonical	ubuntu_linux	6.06	-	-	`cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::`
canonical	ubuntu_linux	6.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:6.10:::::::*`
canonical	ubuntu_linux	7.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
cve.org

访问

25729 vdb-entry
cve.org

访问

GLSA-200711-23 vendor-advisory
cve.org

访问

USN-543-1 vendor-advisory
cve.org

访问

dhcp-param-underflow(33103) vdb-entry
cve.org

访问

1018717 vdb-entry
cve.org

访问

ADV-2007-3229 vdb-entry
cve.org

访问

27694 third-party-advisory
cve.org

访问

20070919 VMWare DHCP Server Remote Code Execution Vulnerabilities third-party-advisory
cve.org

访问