Vulnerability Details : CVE-2007-5671
HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \\.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.
Vulnerability category: Input validation
Products affected by CVE-2007-5671
- cpe:2.3:a:vmware:workstation:5.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workstation:5.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workstation:5.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:esx_server:2.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:server:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:5.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:5.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:5.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_player:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_player:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_player:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_player:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_player:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_server:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_server:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_server:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_server:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:vmware:esx:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:vmware:esx:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:vmware:esx:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:o:vmware:esx:3.0.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2007-5671
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 25 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-5671
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.4
|
MEDIUM | AV:L/AC:M/Au:N/C:P/I:P/A:P |
3.4
|
6.4
|
NIST |
CWE ids for CVE-2007-5671
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-5671
-
http://www.vmware.com/security/advisories/VMSA-2008-0009.html
VMSA-2008-0009.2
-
http://www.securityfocus.com/archive/1/493080/100/0/threaded
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5688
-
http://www.vupen.com/english/advisories/2008/1744
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
http://www.securityfocus.com/archive/1/493148/100/0/threaded
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5358
-
http://securitytracker.com/id?1020197
-
http://www.securityfocus.com/archive/1/493172/100/0/threaded
-
http://securityreason.com/securityalert/3922
-
http://security.gentoo.org/glsa/glsa-201209-25.xml
VMware Player, Server, Workstation: Multiple vulnerabilities (GLSA 201209-25) — Gentoo security
-
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=712
Jump to