Vulnerability Details : CVE-2008-3892
Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call. NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.
Vulnerability category: OverflowExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2008-3892
Probability of exploitation activity in the next 30 days: 79.18%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-3892
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
nvd@nist.gov |
CWE ids for CVE-2008-3892
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-3892
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/43062
VDB Entry
-
http://www.vmware.com/support/player2/doc/releasenotes_player2.html
Vendor Advisory
-
http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html
Third Party Advisory
-
http://www.securityfocus.com/bid/30934
Third Party Advisory;VDB Entry
-
http://securityreason.com/securityalert/4202
Third Party Advisory
-
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html
Vendor Advisory
-
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html
Vendor Advisory
-
https://www.exploit-db.com/exploits/6345
Third Party Advisory;VDB Entry
-
http://www.vmware.com/support/ace/doc/releasenotes_ace.html
Vendor Advisory
-
http://www.vmware.com/support/player/doc/releasenotes_player.html
Vendor Advisory
-
http://www.securityfocus.com/bid/29503
Third Party Advisory;VDB Entry
-
http://www.securityfocus.com/archive/1/495869/100/0/threaded
Third Party Advisory;VDB Entry
-
http://www.vmware.com/support/server/doc/releasenotes_server.html
Vendor Advisory
-
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html
Vendor Advisory
-
http://www.vupen.com/english/advisories/2008/2466
Third Party Advisory
Products affected by CVE-2008-3892
- cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:*:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:server:*:*:*:*:*:*:*:*