Vulnerability CVE-2009-0199


Published: 2009-09-08   Modified: 2012-02-13

Description:
Heap-based buffer overflow in the VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, and VMware ACE 2.5.x before 2.5.3 build 185404 on Windows might allow remote attackers to execute arbitrary code via a video file with crafted dimensions (aka framebuffer parameters).

See advisories in our WLB2 database:
Topic
Author
Date
High
VMware Multiple - security issues
VMware Security ...
10.09.2009

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Vmware -> ACE 
Vmware -> Movie decoder 
Vmware -> Player 
Vmware -> Workstation 

 References:
http://lists.vmware.com/pipermail/security-announce/2009/000065.html
http://www.securityfocus.com/archive/1/506286/100/0/threaded
http://www.securityfocus.com/bid/36290
http://www.vmware.com/security/advisories/VMSA-2009-0012.html
http://www.vupen.com/english/advisories/2009/2553

Copyright 2021, cxsecurity.com

 

Back to Top